2024-12-04T14:25:48Z DEBUG Logging to /var/log/ipaupgrade.log 2024-12-04T14:25:48Z DEBUG ipa-server-upgrade was invoked with arguments [] and options: {'verbose': False, 'quiet': False, 'log_file': None, 'force': False, 'skip_version_check': False} 2024-12-04T14:25:48Z DEBUG IPA version 4.9.14-alt0.p10.3 2024-12-04T14:25:48Z DEBUG IPA platform altlinux 2024-12-04T14:25:48Z DEBUG IPA os-release ALT SP Server 10.2 2024-12-04T14:25:48Z DEBUG importing all plugin modules in ipaserver.plugins... 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.aci 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.automember 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.automount 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.baseldap 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.baseuser 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.batch 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.ca 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.caacl 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.cert 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.certmap 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.certprofile 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.config 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.delegation 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.dns 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.dnsserver 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.dogtag 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.domainlevel 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.group 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hbac 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.hbac is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hbacrule 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hbacsvc 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hbactest 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.host 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.hostgroup 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.idp 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.idrange 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.idviews 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.internal 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.join 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.ldap2 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.location 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.migration 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.misc 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.netgroup 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.otp 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.otp is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.otpconfig 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.otptoken 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.passwd 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.permission 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.ping 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.pkinit 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.privilege 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.pwpolicy 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.rabase 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.rabase is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.radiusproxy 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.realmdomains 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.role 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.schema 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.selfservice 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.server 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.serverrole 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.serverroles 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.service 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.servicedelegation 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.session 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.stageuser 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.subid 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.sudo 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.sudo is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.sudocmd 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.sudorule 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.topology 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.trust 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.user 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.vault 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.virtual 2024-12-04T14:25:48Z DEBUG ipaserver.plugins.virtual is not a valid plugin module 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.whoami 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.plugins.xmlserver 2024-12-04T14:25:48Z DEBUG importing all plugin modules in ipaserver.install.plugins... 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.adtrust 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.dns 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.fix_kra_people_entry 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_changelog_maxage 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_nis 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_pwpolicy 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_referint 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_services 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_unhashed_password 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness 2024-12-04T14:25:48Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Searching for an interface of IP address: ::1 2024-12-04T14:25:49Z DEBUG Testing local IP address: ::1/128 (interface: lo) 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2024-12-04T14:25:49Z DEBUG Starting external process 2024-12-04T14:25:49Z DEBUG args=['/sbin/systemctl', 'is-active', 'dirsrv@FREEIPA-TESTDOMAIN.service'] 2024-12-04T14:25:49Z DEBUG Process finished, return code=3 2024-12-04T14:25:49Z DEBUG stdout=inactive 2024-12-04T14:25:49Z DEBUG stderr= 2024-12-04T14:25:49Z DEBUG Upgrading IPA:. Estimated time: 1 minute 30 seconds 2024-12-04T14:25:49Z DEBUG [1/9]: saving configuration 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:25:49Z DEBUG step duration: dirsrv __save_config 0.05 sec 2024-12-04T14:25:49Z DEBUG [2/9]: disabling listeners 2024-12-04T14:25:49Z DEBUG step duration: dirsrv __disable_listeners 0.04 sec 2024-12-04T14:25:49Z DEBUG [3/9]: enabling DS global lock 2024-12-04T14:25:49Z DEBUG step duration: dirsrv __enable_ds_global_write_lock 0.04 sec 2024-12-04T14:25:49Z DEBUG [4/9]: disabling Schema Compat 2024-12-04T14:25:49Z DEBUG step duration: dirsrv __disable_schema_compat 0.06 sec 2024-12-04T14:25:49Z DEBUG [5/9]: starting directory server 2024-12-04T14:25:49Z DEBUG Starting external process 2024-12-04T14:25:49Z DEBUG args=['/sbin/systemctl', 'start', 'dirsrv@FREEIPA-TESTDOMAIN.service'] 2024-12-04T14:25:51Z DEBUG Process finished, return code=0 2024-12-04T14:25:51Z DEBUG stdout= 2024-12-04T14:25:51Z DEBUG stderr= 2024-12-04T14:25:51Z DEBUG Start of dirsrv@FREEIPA-TESTDOMAIN.service complete 2024-12-04T14:25:51Z DEBUG Created connection context.ldap2_140061389054016 2024-12-04T14:25:51Z DEBUG step duration: dirsrv __start 1.91 sec 2024-12-04T14:25:51Z DEBUG [6/9]: updating schema 2024-12-04T14:25:51Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Frun%2Fslapd-FREEIPA-TESTDOMAIN.socket conn= 2024-12-04T14:25:52Z DEBUG Processing schema LDIF file /usr/share/ipa/60kerberos.ldif 2024-12-04T14:25:52Z DEBUG Processing schema LDIF file /usr/share/ipa/60samba.ldif 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC 'Concatenated MD5 hashes of the salted NT passwords used on this account' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC 'Concatenated MD5 hashes of the salted NT passwords used on this account' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' DESC 'Forest trust information for a trusted domain object' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' DESC 'Forest trust information for a trusted domain object' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC 'Authentication information for the incoming portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC 'Authentication information for the incoming portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC 'Authentication information for the outgoing portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC 'Authentication information for the outgoing portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Schema modlist: [(0, 'attributetypes', [b"( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC " b"path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}" b" X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon Hours' EQUA" b'LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-' b"VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the u" b"nicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115" b".121.1.26{32} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile " b"path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}" b" SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain" b" to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1." b"1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Option Name' EQUA" b'LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1' b".1466.115.121.1.15{256} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Passwo" b"rd' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32}" b" SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC 'Concatenated" b" MD5 hashes of the salted NT passwords used on this account' EQUALITY ca" b"seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} X-ORIGIN 'IPA " b"v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of h" b"ome directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14" b"66.115.121.1.26{4} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Fully qualified" b" name of the domain with which a trust exists' EQUALITY caseIgnoreMatch " b"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS name of a d" b"omain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128" b"} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security ID List' EQ" b'UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} X-ORI' b"GIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' DESC 'Forest " b"trust information for a trusted domain object' EQUALITY caseExactMatch S" b"YNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY ca" b'seIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1' b"466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC 'Authentica" b"tion information for the incoming portion of a trust' EQUALITY caseExact" b"Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DESC 'SID of a " b"trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5Substring" b"sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'I" b"PA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script pat" b"h' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SI" b"NGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Grou" b"p Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1" b"21.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of use" b"r workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch" b" SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4" b".9.14' )", b"( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base64 encoded us" b"er parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115" b".121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC 'Authentica" b"tion information for the outgoing portion of a trust' EQUALITY caseExact" b"Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQU" b'ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE' b"-VALUE X-ORIGIN 'IPA v4.9.14' )"])] 2024-12-04T14:25:52Z DEBUG update_entry modlist [(0, 'attributetypes', [b"( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC 'Concatenated MD5 hashes of the salted NT passwords used on this account' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' DESC 'Forest trust information for a trusted domain object' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC 'Authentication information for the incoming portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC 'Authentication information for the outgoing portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE X-ORIGIN 'IPA v4.9.14' )"])] 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlatName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdentifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlatName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdentifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Configuration Section' SUP top AUXILIARY MAY description X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Configuration Section' SUP top AUXILIARY MAY description X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviousClearTextPassword X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviousClearTextPassword X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share Section' SUP top STRUCTURAL MUST sambaShareName MAY description X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share Section' SUP top STRUCTURAL MUST sambaShareName MAY description X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description $ sambaSIDList ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description $ sambaSIDList ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gidNumber ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gidNumber ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for a SID' SUP top STRUCTURAL MUST sambaSID X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for a SID' SUP top STRUCTURAL MUST sambaSID X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListOption $ description ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListOption $ description ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Replace: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:52Z DEBUG with: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:52Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Samba Trusted " b"Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $ sambaTr" b'ustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlatName ' b'$ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdentif' b'ier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupported' b"EncryptionTypes ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Informati" b"on' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNe" b'xtRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase $' b' sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaM' b'axPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservati' b'onWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachine' b"PwdChange ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Configuration S" b"ection' SUP top AUXILIARY MAY description X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Samba Trust Pa" b"ssword' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassword $ sa" b"mbaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) X-ORIGIN 'IPA v4.9.14" b"' )", b"( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' DESC 'Samba " b"Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sam" b'baSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviousClea' b"rTextPassword X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share Section' S" b"UP top STRUCTURAL MUST sambaShareName MAY description X-ORIGIN 'IPA v4.9" b".14' )", b"( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocatin" b"g UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) X-ORI" b"GIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapp" b"ing' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MA" b"Y ( displayName $ description $ sambaSIDList ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID" b" to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gidNumber )" b" X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for" b" a SID' SUP top STRUCTURAL MUST sambaSID X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samba Configura" b"tion Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sambaBoolOpti" b'on $ sambaIntegerOption $ sambaStringOption $ sambaStringListOption $ de' b"scription ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary" b" SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ samba" b'LMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaL' b'ogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ ' b'sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLog' b'onScript $ sambaProfilePath $ description $ sambaUserWorkstations $ samb' b'aPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordC' b'ount $ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) X' b"-ORIGIN 'IPA v4.9.14' )"])] 2024-12-04T14:25:52Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlatName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdentifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Configuration Section' SUP top AUXILIARY MAY description X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviousClearTextPassword X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share Section' SUP top STRUCTURAL MUST sambaShareName MAY description X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description $ sambaSIDList ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gidNumber ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for a SID' SUP top STRUCTURAL MUST sambaSID X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListOption $ description ) X-ORIGIN 'IPA v4.9.14' )", b"( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) X-ORIGIN 'IPA v4.9.14' )"])] 2024-12-04T14:25:53Z DEBUG Processing schema LDIF file /usr/share/ipa/60ipaconfig.ldif 2024-12-04T14:25:53Z DEBUG Processing schema LDIF file /usr/share/ipa/60basev2.ldif 2024-12-04T14:25:53Z DEBUG Replace: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' DESC 'Automount Map information' SUP top STRUCTURAL MUST automountMapName MAY description X-ORIGIN ( 'RFC 2307bis' 'user defined' ) ) 2024-12-04T14:25:53Z DEBUG with: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' DESC 'Automount Map information' SUP top STRUCTURAL MUST automountMapName MAY description X-ORIGIN 'RFC 2307bis' ) 2024-12-04T14:25:53Z DEBUG Replace: ( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount information' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY description X-ORIGIN ( 'RFC 2307bis' 'user defined' ) ) 2024-12-04T14:25:53Z DEBUG with: ( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount information' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY description X-ORIGIN 'RFC 2307bis' ) 2024-12-04T14:25:53Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 1.3.6.1.1.1.2.16 NAME 'automountMap' DESC 'Automount Map information' " b"SUP top STRUCTURAL MUST automountMapName MAY description X-ORIGIN 'RFC 2" b"307bis' )", b"( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount information' SUP top" b' STRUCTURAL MUST ( automountKey $ automountInformation ) MAY description' b" X-ORIGIN 'RFC 2307bis' )"])] 2024-12-04T14:25:53Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 1.3.6.1.1.1.2.16 NAME 'automountMap' DESC 'Automount Map information' SUP top STRUCTURAL MUST automountMapName MAY description X-ORIGIN 'RFC 2307bis' )", b"( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount information' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY description X-ORIGIN 'RFC 2307bis' )"])] 2024-12-04T14:25:53Z DEBUG Processing schema LDIF file /usr/share/ipa/60basev3.ldif 2024-12-04T14:25:53Z DEBUG Replace: ( 2.16.840.1.113730.3.8.11.52 NAME 'ipaProtectedOperation' DESC 'Operation to be protected' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:53Z DEBUG with: ( 2.16.840.1.113730.3.8.11.52 NAME 'ipaProtectedOperation' DESC 'Operation to be protected' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:53Z DEBUG Replace: ( 2.16.840.1.113730.3.8.11.14 NAME 'ipaNTTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 2024-12-04T14:25:53Z DEBUG with: ( 2.16.840.1.113730.3.8.11.14 NAME 'ipaNTTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:53Z DEBUG Replace: ( 2.16.840.1.113730.3.8.11.51 NAME 'ipaAllowedToPerform' DESC 'DNs allowed to perform an operation' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v4.0' ) 2024-12-04T14:25:53Z DEBUG with: ( 2.16.840.1.113730.3.8.11.51 NAME 'ipaAllowedToPerform' DESC 'DNs allowed to perform an operation' SUP distinguishedName X-ORIGIN 'IPA v4.0' ) 2024-12-04T14:25:53Z DEBUG Schema modlist: [(0, 'attributetypes', [b"( 2.16.840.1.113730.3.8.11.52 NAME 'ipaProtectedOperation' DESC 'Operati" b"on to be protected' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115" b".121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 2.16.840.1.113730.3.8.11.14 NAME 'ipaNTTrustPartner' DESC 'Fully quali" b"fied name of the domain with which a trust exists' EQUALITY caseIgnoreMa" b"tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 2.16.840.1.113730.3.8.11.51 NAME 'ipaAllowedToPerform' DESC 'DNs allow" b"ed to perform an operation' SUP distinguishedName X-ORIGIN 'IPA v4.0' )"])] 2024-12-04T14:25:53Z DEBUG update_entry modlist [(0, 'attributetypes', [b"( 2.16.840.1.113730.3.8.11.52 NAME 'ipaProtectedOperation' DESC 'Operation to be protected' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 2.16.840.1.113730.3.8.11.14 NAME 'ipaNTTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} X-ORIGIN 'IPA v4.9.14' )", b"( 2.16.840.1.113730.3.8.11.51 NAME 'ipaAllowedToPerform' DESC 'DNs allowed to perform an operation' SUP distinguishedName X-ORIGIN 'IPA v4.0' )"])] 2024-12-04T14:25:53Z DEBUG Processing schema LDIF file /usr/share/ipa/60basev4.ldif 2024-12-04T14:25:53Z DEBUG Replace: ( 2.16.840.1.113730.3.8.24.5 NAME 'ipaSubordinateIdEntry' DESC 'Subordinate uid and gid entry' SUP top STRUCTURAL MUST ipaUniqueID MAY description X-ORIGIN 'IPA v4.9' ) 2024-12-04T14:25:53Z DEBUG with: ( 2.16.840.1.113730.3.8.24.5 NAME 'ipaSubordinateIdEntry' DESC 'Subordinate uid and gid entry' SUP top STRUCTURAL MUST ipaUniqueId MAY description X-ORIGIN 'IPA v4.9' ) 2024-12-04T14:25:53Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.8.24.5 NAME 'ipaSubordinateIdEntry' DESC 'Subordin" b"ate uid and gid entry' SUP top STRUCTURAL MUST ipaUniqueId MAY descripti" b"on X-ORIGIN 'IPA v4.9' )"])] 2024-12-04T14:25:53Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.8.24.5 NAME 'ipaSubordinateIdEntry' DESC 'Subordinate uid and gid entry' SUP top STRUCTURAL MUST ipaUniqueId MAY description X-ORIGIN 'IPA v4.9' )"])] 2024-12-04T14:25:54Z DEBUG Processing schema LDIF file /usr/share/ipa/60ipapk11.ldif 2024-12-04T14:25:54Z DEBUG Processing schema LDIF file /usr/share/ipa/60ipadns.ldif 2024-12-04T14:25:54Z DEBUG Processing schema LDIF file /usr/share/ipa/60certificate-profiles.ldif 2024-12-04T14:25:54Z DEBUG Replace: ( 2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Issuer DN' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v4.4 Lightweight CAs' ) 2024-12-04T14:25:54Z DEBUG with: ( 2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Issuer DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' ) 2024-12-04T14:25:54Z DEBUG Replace: ( 2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'Subject DN' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v4.4 Lightweight CAs' ) 2024-12-04T14:25:54Z DEBUG with: ( 2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'Subject DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' ) 2024-12-04T14:25:54Z DEBUG Schema modlist: [(0, 'attributetypes', [b"( 2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Issuer DN' SUP" b" distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )", b"( 2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'Subject DN' S" b"UP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )"])] 2024-12-04T14:25:54Z DEBUG update_entry modlist [(0, 'attributetypes', [b"( 2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Issuer DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )", b"( 2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'Subject DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )"])] 2024-12-04T14:25:54Z DEBUG Replace: ( 2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssociation STRUCTURAL MAY ( ipaCaCategory $ ipaCertProfileCategory $ serviceCategory $ ipaMemberCa $ ipaMemberCertProfile $ memberService ) X-ORIGIN 'IPA v4.2' ) 2024-12-04T14:25:54Z DEBUG with: ( 2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssociation STRUCTURAL MUST cn MAY ( ipaCaCategory $ ipaCertProfileCategory $ userCategory $ hostCategory $ serviceCategory $ ipaMemberCa $ ipaMemberCertProfile $ memberService ) X-ORIGIN 'IPA v4.2' ) 2024-12-04T14:25:54Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssociation STRUCT" b'URAL MUST cn MAY ( ipaCaCategory $ ipaCertProfileCategory $ userCategory' b' $ hostCategory $ serviceCategory $ ipaMemberCa $ ipaMemberCertProfile $' b" memberService ) X-ORIGIN 'IPA v4.2' )"])] 2024-12-04T14:25:54Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssociation STRUCTURAL MUST cn MAY ( ipaCaCategory $ ipaCertProfileCategory $ userCategory $ hostCategory $ serviceCategory $ ipaMemberCa $ ipaMemberCertProfile $ memberService ) X-ORIGIN 'IPA v4.2' )"])] 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/61kerberos-ipav3.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/65ipacertstore.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/65ipasudo.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/70ipaotp.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/70topology.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/71idviews.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/72domainlevels.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/73certmap.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/15rfc2307bis.ldif 2024-12-04T14:25:55Z DEBUG Replace: ( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' SUP top STRUCTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) X-ORIGIN 'user defined' ) 2024-12-04T14:25:55Z DEBUG with: ( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' SUP top STRUCTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) X-ORIGIN 'IPA v4.9.14' ) 2024-12-04T14:25:55Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' SUP top STRU" b"CTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) X-ORIGIN 'IPA v4.9.14" b"' )"])] 2024-12-04T14:25:55Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' SUP top STRUCTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) X-ORIGIN 'IPA v4.9.14' )"])] 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/15rfc4876.ldif 2024-12-04T14:25:55Z DEBUG Processing schema LDIF file /usr/share/ipa/05rfc2247.ldif 2024-12-04T14:25:55Z DEBUG Replace: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 4519' X-DEPRECATED 'domaincomponent' ) 2024-12-04T14:25:55Z DEBUG with: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) DESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 2247' ) 2024-12-04T14:25:55Z DEBUG Replace: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4524' ) 2024-12-04T14:25:55Z DEBUG with: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 1274' ) 2024-12-04T14:25:55Z DEBUG Schema modlist: [(0, 'attributetypes', [b"( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) DESC 'Stand" b"ard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA" b'5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORI' b"GIN 'RFC 2247' )", b"( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'Standard LDAP a" b"ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 1274' " b')'])] 2024-12-04T14:25:55Z DEBUG update_entry modlist [(0, 'attributetypes', [b"( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) DESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC 2247' )", b"( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 1274' )"])] 2024-12-04T14:25:55Z DEBUG Replace: ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' SUP top AUXILIARY MUST dc X-ORIGIN 'RFC 4519' ) 2024-12-04T14:25:55Z DEBUG with: ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'Standard LDAP objectclass' SUP top AUXILIARY MUST dc X-ORIGIN 'RFC 2247' ) 2024-12-04T14:25:55Z DEBUG Replace: ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCTURAL MUST dc MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationalISDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description $ o $ associatedName ) X-ORIGIN 'RFC 4524' ) 2024-12-04T14:25:55Z DEBUG with: ( 0.9.2342.19200300.100.4.13 NAME 'domain' DESC 'Standard LDAP objectclass' SUP top STRUCTURAL MUST dc MAY ( associatedName $ businessCategory $ description $ destinationIndicator $ facsimileTelephoneNumber $ internationalISDNNumber $ l $ o $ physicalDeliveryOfficeName $ postOfficeBox $ postalAddress $ postalCode $ preferredDeliveryMethod $ registeredAddress $ searchGuide $ seeAlso $ st $ street $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ userPassword $ x121Address ) X-ORIGIN 'RFC 2247' ) 2024-12-04T14:25:55Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'Standard LDAP objectclass' " b"SUP top AUXILIARY MUST dc X-ORIGIN 'RFC 2247' )", b"( 0.9.2342.19200300.100.4.13 NAME 'domain' DESC 'Standard LDAP objectcla" b"ss' SUP top STRUCTURAL MUST dc MAY ( associatedName $ businessCategory $" b' description $ destinationIndicator $ facsimileTelephoneNumber $ interna' b'tionalISDNNumber $ l $ o $ physicalDeliveryOfficeName $ postOfficeBox $ ' b'postalAddress $ postalCode $ preferredDeliveryMethod $ registeredAddress' b' $ searchGuide $ seeAlso $ st $ street $ telephoneNumber $ teletexTermin' b"alIdentifier $ telexNumber $ userPassword $ x121Address ) X-ORIGIN 'RFC " b"2247' )"])] 2024-12-04T14:25:56Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'Standard LDAP objectclass' SUP top AUXILIARY MUST dc X-ORIGIN 'RFC 2247' )", b"( 0.9.2342.19200300.100.4.13 NAME 'domain' DESC 'Standard LDAP objectclass' SUP top STRUCTURAL MUST dc MAY ( associatedName $ businessCategory $ description $ destinationIndicator $ facsimileTelephoneNumber $ internationalISDNNumber $ l $ o $ physicalDeliveryOfficeName $ postOfficeBox $ postalAddress $ postalCode $ preferredDeliveryMethod $ registeredAddress $ searchGuide $ seeAlso $ st $ street $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ userPassword $ x121Address ) X-ORIGIN 'RFC 2247' )"])] 2024-12-04T14:25:56Z DEBUG Replace: ( 0.9.2342.19200300.100.4.14 NAME 'rFC822localPart' SUP domain STRUCTURAL MAY ( cn $ sn ) X-ORIGIN 'RFC 4524' ) 2024-12-04T14:25:56Z DEBUG with: ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' DESC 'Pilot objectclass' SUP domain STRUCTURAL MAY ( cn $ sn ) X-ORIGIN 'Internet directory pilot' ) 2024-12-04T14:25:56Z DEBUG Schema modlist: [(0, 'objectclasses', [b"( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' DESC 'Pilot objectcl" b"ass' SUP domain STRUCTURAL MAY ( cn $ sn ) X-ORIGIN 'Internet directory " b"pilot' )"])] 2024-12-04T14:25:56Z DEBUG update_entry modlist [(0, 'objectclasses', [b"( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' DESC 'Pilot objectclass' SUP domain STRUCTURAL MAY ( cn $ sn ) X-ORIGIN 'Internet directory pilot' )"])] 2024-12-04T14:25:56Z DEBUG step duration: dirsrv __update_schema 5.42 sec 2024-12-04T14:25:56Z DEBUG [7/9]: upgrading server 2024-12-04T14:25:56Z DEBUG importing all plugin modules in ipaserver.plugins... 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.aci 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.automember 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.automount 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.baseldap 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.baseuser 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.batch 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.ca 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.caacl 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.cert 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.certmap 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.certprofile 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.config 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.delegation 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.dns 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.dnsserver 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.dogtag 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.domainlevel 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.group 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hbac 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.hbac is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hbacrule 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hbacsvc 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hbactest 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.host 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.hostgroup 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.idp 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.idrange 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.idviews 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.internal 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.join 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.ldap2 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.location 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.migration 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.misc 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.netgroup 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.otp 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.otp is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.otpconfig 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.otptoken 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.passwd 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.permission 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.ping 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.pkinit 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.privilege 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.pwpolicy 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.rabase 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.rabase is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.radiusproxy 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.realmdomains 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.role 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.schema 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.selfservice 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.server 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.serverrole 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.serverroles 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.service 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.servicedelegation 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.session 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.stageuser 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.subid 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.sudo 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.sudo is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.sudocmd 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.sudorule 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.topology 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.trust 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.user 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.vault 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.virtual 2024-12-04T14:25:56Z DEBUG ipaserver.plugins.virtual is not a valid plugin module 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.whoami 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.plugins.xmlserver 2024-12-04T14:25:56Z DEBUG importing all plugin modules in ipaserver.install.plugins... 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.adtrust 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.dns 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.fix_kra_people_entry 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_changelog_maxage 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_nis 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_pwpolicy 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_referint 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_services 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_unhashed_password 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness 2024-12-04T14:25:56Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt 2024-12-04T14:25:57Z DEBUG Created connection context.ldap2_140061374847008 2024-12-04T14:25:57Z DEBUG raw: idrange_show('FREEIPA.TESTDOMAIN_id_range', version='2.251') 2024-12-04T14:25:57Z DEBUG idrange_show('FREEIPA.TESTDOMAIN_id_range', rights=False, all=False, raw=False, version='2.251') 2024-12-04T14:25:57Z DEBUG flushing ldapi://%2Frun%2Fslapd-FREEIPA-TESTDOMAIN.socket from SchemaCache 2024-12-04T14:25:57Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Frun%2Fslapd-FREEIPA-TESTDOMAIN.socket conn= 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/05-pre_upgrade_plugins.update' 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_managed_post_first 2024-12-04T14:25:58Z DEBUG raw: update_managed_post_first 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_changelog_maxage 2024-12-04T14:25:58Z DEBUG raw: update_changelog_maxage 2024-12-04T14:25:58Z DEBUG Error retrieving: cn=changelog5,cn=config 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_replica_attribute_lists 2024-12-04T14:25:58Z DEBUG raw: update_replica_attribute_lists 2024-12-04T14:25:58Z DEBUG Start replication agreement exclude list update task 2024-12-04T14:25:58Z DEBUG raw: topologysuffix_find(None, version='2.251') 2024-12-04T14:25:58Z DEBUG topologysuffix_find(None, all=False, raw=False, version='2.251', pkey_only=False) 2024-12-04T14:25:58Z DEBUG raw: topologysegment_find('ca', None, all=True, version='2.251') 2024-12-04T14:25:58Z DEBUG topologysegment_find('ca', None, all=True, raw=False, version='2.251', pkey_only=False) 2024-12-04T14:25:58Z DEBUG raw: topologysegment_find('domain', None, all=True, version='2.251') 2024-12-04T14:25:58Z DEBUG topologysegment_find('domain', None, all=True, raw=False, version='2.251', pkey_only=False) 2024-12-04T14:25:58Z DEBUG Done updating agreements 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_passync_privilege_check 2024-12-04T14:25:58Z DEBUG raw: update_passync_privilege_check 2024-12-04T14:25:58Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:25:58Z DEBUG PassSync privilege update pre-check not needed 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_referint 2024-12-04T14:25:58Z DEBUG raw: update_referint 2024-12-04T14:25:58Z DEBUG Upgrading referential integrity plugin configuration 2024-12-04T14:25:58Z DEBUG Initial value: LDAPEntry(ipapython.dn.DN('cn=referential integrity postoperation,cn=plugins,cn=config'), {'cn': [b'referential integrity postoperation'], 'nsslapd-plugin-depends-on-type': [b'database'], 'nsslapd-pluginDescription': [b'referential integrity plugin'], 'nsslapd-pluginEnabled': [b'on'], 'nsslapd-pluginId': [b'referint'], 'nsslapd-pluginInitfunc': [b'referint_postop_init'], 'nsslapd-pluginPath': [b'libreferint-plugin'], 'nsslapd-pluginType': [b'betxnpostoperation'], 'nsslapd-pluginVendor': [b'389 Project'], 'nsslapd-pluginVersion': [b'2.4.6'], 'nsslapd-plugincontainerscope': [b'dc=freeipa,dc=testdomain'], 'nsslapd-pluginentryscope': [b'dc=freeipa,dc=testdomain'], 'nsslapd-pluginexcludeentryscope': [b'cn=provisioning,dc=freeipa,dc=testdomain'], 'nsslapd-pluginprecedence': [b'40'], 'objectClass': [b'top', b'nsSlapdPlugin', b'extensibleObject'], 'referint-logfile': [b'/var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint'], 'referint-membership-attr': [b'member', b'uniquemember', b'owner', b'seeAlso', b'manager', b'secretary', b'memberuser', b'memberhost', b'sourcehost', b'memberservice', b'managedby', b'memberallowcmd', b'memberdenycmd', b'ipasudorunas', b'ipasudorunasgroup', b'ipatokenradiusconfiglink', b'ipaassignedidview', b'ipaallowedtarget', b'ipamemberca', b'ipamembercertprofile', b'ipalocation', b'membermanager', b'ipaowner', b'ipaidpconfiglink'], 'referint-update-delay': [b'0']}) 2024-12-04T14:25:58Z DEBUG Plugin already uses new style, skipping 2024-12-04T14:25:58Z DEBUG Executing upgrade plugin: update_uniqueness_plugins_to_new_syntax 2024-12-04T14:25:58Z DEBUG raw: update_uniqueness_plugins_to_new_syntax 2024-12-04T14:25:58Z DEBUG No uniqueness plugin entries with old style configuration found 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/05-pre_upgrade_plugins.update 0.014 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-config.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-ssl-check-hostname to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Kerberos Principal Name 2024-12-04T14:25:58Z DEBUG ipamodrdnfilter: 2024-12-04T14:25:58Z DEBUG (&(objectclass=posixaccount)(objectclass=krbPrincipalAux)) 2024-12-04T14:25:58Z DEBUG ipamodrdnscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG ipamodrdnsourceattr: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG ipamodrdnsuffix: 2024-12-04T14:25:58Z DEBUG @FREEIPA.TESTDOMAIN 2024-12-04T14:25:58Z DEBUG ipamodrdntargetattr: 2024-12-04T14:25:58Z DEBUG krbPrincipalName 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG remove: '60' from nsslapd-pluginPrecedence, current value [] 2024-12-04T14:25:58Z DEBUG remove: '60' not in nsslapd-pluginPrecedence 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Kerberos Principal Name 2024-12-04T14:25:58Z DEBUG ipamodrdnfilter: 2024-12-04T14:25:58Z DEBUG (&(objectclass=posixaccount)(objectclass=krbPrincipalAux)) 2024-12-04T14:25:58Z DEBUG ipamodrdnscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG ipamodrdnsourceattr: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG ipamodrdnsuffix: 2024-12-04T14:25:58Z DEBUG @FREEIPA.TESTDOMAIN 2024-12-04T14:25:58Z DEBUG ipamodrdntargetattr: 2024-12-04T14:25:58Z DEBUG krbPrincipalName 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA MODRDN plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipamodrdn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_modrdn 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG Red Hat, Inc. 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginPrecedence to '60', current value ['60'] 2024-12-04T14:25:58Z DEBUG only: updated value ['60'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA MODRDN plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipamodrdn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_modrdn 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG Red Hat, Inc. 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG replace: 2000 not found, skipping 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapd-lookthroughlimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-idlistscanlimit: 2024-12-04T14:25:58Z DEBUG 2147483646 2024-12-04T14:25:58Z DEBUG nsslapd-directory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-idl-switch: 2024-12-04T14:25:58Z DEBUG new 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-search-use-vlv-index: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-exclude-from-export: 2024-12-04T14:25:58Z DEBUG entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-subtree-rename-switch: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pagedlookthroughlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-pagedidlistscanlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-rangelookthroughlimit: 2024-12-04T14:25:58Z DEBUG 5000 2024-12-04T14:25:58Z DEBUG nsslapd-backend-opt-level: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-backend-implement: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG replace: 5000 not found, skipping 2024-12-04T14:25:58Z DEBUG replace: 4000 not found, skipping 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapd-lookthroughlimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-idlistscanlimit: 2024-12-04T14:25:58Z DEBUG 2147483646 2024-12-04T14:25:58Z DEBUG nsslapd-directory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-idl-switch: 2024-12-04T14:25:58Z DEBUG new 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-search-use-vlv-index: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-exclude-from-export: 2024-12-04T14:25:58Z DEBUG entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-subtree-rename-switch: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pagedlookthroughlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-pagedidlistscanlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-rangelookthroughlimit: 2024-12-04T14:25:58Z DEBUG 5000 2024-12-04T14:25:58Z DEBUG nsslapd-backend-opt-level: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-backend-implement: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG anonymous-limits 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG anonymous-limits 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-anonlimitsdn to 'cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain', current value ['cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG only: updated value ['cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG add: 'dc=freeipa,dc=testdomain' to nsslapd-defaultNamingContext, current value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-minssf-exclude-rootdse to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa-winsync 2024-12-04T14:25:58Z DEBUG ipawinsyncacctdisable: 2024-12-04T14:25:58Z DEBUG both 2024-12-04T14:25:58Z DEBUG ipawinsyncdefaultgroupattr: 2024-12-04T14:25:58Z DEBUG ipaDefaultPrimaryGroup 2024-12-04T14:25:58Z DEBUG ipawinsyncdefaultgroupfilter: 2024-12-04T14:25:58Z DEBUG (gidNumber=*)(objectclass=posixGroup)(objectclass=groupOfNames) 2024-12-04T14:25:58Z DEBUG ipawinsyncforcesync: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG ipawinsynchomedirattr: 2024-12-04T14:25:58Z DEBUG ipaHomesRootDir 2024-12-04T14:25:58Z DEBUG ipawinsyncloginshellattr: 2024-12-04T14:25:58Z DEBUG ipaDefaultLoginShell 2024-12-04T14:25:58Z DEBUG ipawinsyncnewentryfilter: 2024-12-04T14:25:58Z DEBUG (cn=ipaConfig) 2024-12-04T14:25:58Z DEBUG ipawinsyncnewuserocattr: 2024-12-04T14:25:58Z DEBUG ipauserobjectclasses 2024-12-04T14:25:58Z DEBUG ipawinsyncrealmattr: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG ipawinsyncrealmfilter: 2024-12-04T14:25:58Z DEBUG (objectclass=krbRealmContainer) 2024-12-04T14:25:58Z DEBUG ipawinsyncuserattr: 2024-12-04T14:25:58Z DEBUG uidNumber -1 2024-12-04T14:25:58Z DEBUG gidNumber -1 2024-12-04T14:25:58Z DEBUG ipawinsyncuserflatten: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG ipa winsync plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG ipa-winsync-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipa_winsync_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_winsync 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginPrecedence to '60', current value ['60'] 2024-12-04T14:25:58Z DEBUG only: updated value ['60'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa-winsync 2024-12-04T14:25:58Z DEBUG ipawinsyncacctdisable: 2024-12-04T14:25:58Z DEBUG both 2024-12-04T14:25:58Z DEBUG ipawinsyncdefaultgroupattr: 2024-12-04T14:25:58Z DEBUG ipaDefaultPrimaryGroup 2024-12-04T14:25:58Z DEBUG ipawinsyncdefaultgroupfilter: 2024-12-04T14:25:58Z DEBUG (gidNumber=*)(objectclass=posixGroup)(objectclass=groupOfNames) 2024-12-04T14:25:58Z DEBUG ipawinsyncforcesync: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG ipawinsynchomedirattr: 2024-12-04T14:25:58Z DEBUG ipaHomesRootDir 2024-12-04T14:25:58Z DEBUG ipawinsyncloginshellattr: 2024-12-04T14:25:58Z DEBUG ipaDefaultLoginShell 2024-12-04T14:25:58Z DEBUG ipawinsyncnewentryfilter: 2024-12-04T14:25:58Z DEBUG (cn=ipaConfig) 2024-12-04T14:25:58Z DEBUG ipawinsyncnewuserocattr: 2024-12-04T14:25:58Z DEBUG ipauserobjectclasses 2024-12-04T14:25:58Z DEBUG ipawinsyncrealmattr: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG ipawinsyncrealmfilter: 2024-12-04T14:25:58Z DEBUG (objectclass=krbRealmContainer) 2024-12-04T14:25:58Z DEBUG ipawinsyncuserattr: 2024-12-04T14:25:58Z DEBUG uidNumber -1 2024-12-04T14:25:58Z DEBUG gidNumber -1 2024-12-04T14:25:58Z DEBUG ipawinsyncuserflatten: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG ipa winsync plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG ipa-winsync-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipa_winsync_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_winsync 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-sasl-mapping-fallback to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Full Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Full Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Full Principal 2024-12-04T14:25:58Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:25:58Z DEBUG (krbPrincipalName=\1@\2) 2024-12-04T14:25:58Z DEBUG nsSaslMapPriority: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsSaslMapRegexString: 2024-12-04T14:25:58Z DEBUG \(.*\)@\(.*\) 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSaslMapping 2024-12-04T14:25:58Z DEBUG addifnew: '10' to nsSaslMapPriority, current value ['10'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Full Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Full Principal 2024-12-04T14:25:58Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:25:58Z DEBUG (krbPrincipalName=\1@\2) 2024-12-04T14:25:58Z DEBUG nsSaslMapPriority: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsSaslMapRegexString: 2024-12-04T14:25:58Z DEBUG \(.*\)@\(.*\) 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSaslMapping 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Name Only,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Name Only,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Name Only 2024-12-04T14:25:58Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:25:58Z DEBUG (krbPrincipalName=&@FREEIPA.TESTDOMAIN) 2024-12-04T14:25:58Z DEBUG nsSaslMapPriority: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsSaslMapRegexString: 2024-12-04T14:25:58Z DEBUG ^[^:@]+$ 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSaslMapping 2024-12-04T14:25:58Z DEBUG addifnew: '10' to nsSaslMapPriority, current value ['10'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Name Only,cn=mapping,cn=sasl,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Name Only 2024-12-04T14:25:58Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:25:58Z DEBUG (krbPrincipalName=&@FREEIPA.TESTDOMAIN) 2024-12-04T14:25:58Z DEBUG nsSaslMapPriority: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsSaslMapRegexString: 2024-12-04T14:25:58Z DEBUG ^[^:@]+$ 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSaslMapping 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-allow-hashed-passwords to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-ioblocktimeout to '10000', current value ['10000'] 2024-12-04T14:25:58Z DEBUG only: updated value ['10000'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG only: set nsslapd-enable-upgrade-hash to 'off', current value ['off'] 2024-12-04T14:25:58Z DEBUG only: updated value ['off'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:58Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:58Z DEBUG dirsrv-log 2024-12-04T14:25:58Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:58Z DEBUG process-safe 2024-12-04T14:25:58Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:58Z DEBUG 30 2024-12-04T14:25:58Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:58Z DEBUG 300 2024-12-04T14:25:58Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordStorageScheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG passwordAdminDN: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:58Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:58Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-config.update 0.593 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-db-locks.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG extensibleobject 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsslapd-dbcachesize: 2024-12-04T14:25:58Z DEBUG 155789721 2024-12-04T14:25:58Z DEBUG nsslapd-db-logdirectory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-db-durable-transaction: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-wait: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-db-checkpoint-interval: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-db-compactdb-interval: 2024-12-04T14:25:58Z DEBUG 2592000 2024-12-04T14:25:58Z DEBUG nsslapd-db-compactdb-time: 2024-12-04T14:25:58Z DEBUG 23:59 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-val: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-min-wait: 2024-12-04T14:25:58Z DEBUG 50 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-max-wait: 2024-12-04T14:25:58Z DEBUG 50 2024-12-04T14:25:58Z DEBUG nsslapd-db-logbuf-size: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks: 2024-12-04T14:25:58Z DEBUG 50000 2024-12-04T14:25:58Z DEBUG nsslapd-db-private-import-mem: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-home-directory: 2024-12-04T14:25:58Z DEBUG /dev/shm/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-import-cache-autosize: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-cache-autosize: 2024-12-04T14:25:58Z DEBUG 25 2024-12-04T14:25:58Z DEBUG nsslapd-cache-autosize-split: 2024-12-04T14:25:58Z DEBUG 25 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-deadlock-policy: 2024-12-04T14:25:58Z DEBUG 9 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 90 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-pause: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG replace: 10000 not found, skipping 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG extensibleobject 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsslapd-dbcachesize: 2024-12-04T14:25:58Z DEBUG 155789721 2024-12-04T14:25:58Z DEBUG nsslapd-db-logdirectory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-db-durable-transaction: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-wait: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-db-checkpoint-interval: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-db-compactdb-interval: 2024-12-04T14:25:58Z DEBUG 2592000 2024-12-04T14:25:58Z DEBUG nsslapd-db-compactdb-time: 2024-12-04T14:25:58Z DEBUG 23:59 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-val: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-min-wait: 2024-12-04T14:25:58Z DEBUG 50 2024-12-04T14:25:58Z DEBUG nsslapd-db-transaction-batch-max-wait: 2024-12-04T14:25:58Z DEBUG 50 2024-12-04T14:25:58Z DEBUG nsslapd-db-logbuf-size: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks: 2024-12-04T14:25:58Z DEBUG 50000 2024-12-04T14:25:58Z DEBUG nsslapd-db-private-import-mem: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-home-directory: 2024-12-04T14:25:58Z DEBUG /dev/shm/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-import-cache-autosize: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-cache-autosize: 2024-12-04T14:25:58Z DEBUG 25 2024-12-04T14:25:58Z DEBUG nsslapd-cache-autosize-split: 2024-12-04T14:25:58Z DEBUG 25 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-deadlock-policy: 2024-12-04T14:25:58Z DEBUG 9 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 90 2024-12-04T14:25:58Z DEBUG nsslapd-db-locks-monitoring-pause: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapd-lookthroughlimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-idlistscanlimit: 2024-12-04T14:25:58Z DEBUG 2147483646 2024-12-04T14:25:58Z DEBUG nsslapd-directory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-idl-switch: 2024-12-04T14:25:58Z DEBUG new 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-search-use-vlv-index: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-exclude-from-export: 2024-12-04T14:25:58Z DEBUG entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-subtree-rename-switch: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pagedlookthroughlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-pagedidlistscanlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-rangelookthroughlimit: 2024-12-04T14:25:58Z DEBUG 5000 2024-12-04T14:25:58Z DEBUG nsslapd-backend-opt-level: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-backend-implement: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG remove: '50000' from nsslapd-db-locks, current value [] 2024-12-04T14:25:58Z DEBUG remove: '50000' not in nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=config,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapd-lookthroughlimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-idlistscanlimit: 2024-12-04T14:25:58Z DEBUG 2147483646 2024-12-04T14:25:58Z DEBUG nsslapd-directory: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db 2024-12-04T14:25:58Z DEBUG nsslapd-import-cachesize: 2024-12-04T14:25:58Z DEBUG 16777216 2024-12-04T14:25:58Z DEBUG nsslapd-idl-switch: 2024-12-04T14:25:58Z DEBUG new 2024-12-04T14:25:58Z DEBUG nsslapd-search-bypass-filter-test: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-search-use-vlv-index: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-exclude-from-export: 2024-12-04T14:25:58Z DEBUG entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn 2024-12-04T14:25:58Z DEBUG nsslapd-serial-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-subtree-rename-switch: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pagedlookthroughlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-pagedidlistscanlimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-rangelookthroughlimit: 2024-12-04T14:25:58Z DEBUG 5000 2024-12-04T14:25:58Z DEBUG nsslapd-backend-opt-level: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-backend-implement: 2024-12-04T14:25:58Z DEBUG bdb 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-db-locks.update 0.012 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-enable-betxn.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG 7-bit check 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NS7bitAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NS7bitAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:25:58Z DEBUG mail 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:25:58Z DEBUG , 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG 7-bit check 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NS7bitAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NS7bitAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:25:58Z DEBUG mail 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:25:58Z DEBUG , 2024-12-04T14:25:58Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=attribute uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=attribute uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG attribute uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=attribute uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG attribute uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG automemberprocessmodifyops: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Auto Membership Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Auto Membership plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Auto Membership 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG automember_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libautomember-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG automemberprocessmodifyops: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Auto Membership Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Auto Membership plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Auto Membership 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG automember_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libautomember-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Linked Attributes 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Linked Attributes plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Linked Attributes 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG linked_attrs_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG liblinkedattrs-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Linked Attributes 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Linked Attributes plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Linked Attributes 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG linked_attrs_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG liblinkedattrs-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Managed Entries plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG mep_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Managed Entries plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG mep_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG MemberOf Plugin 2024-12-04T14:25:58Z DEBUG memberofattr: 2024-12-04T14:25:58Z DEBUG memberOf 2024-12-04T14:25:58Z DEBUG memberofentryscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG memberofgroupattr: 2024-12-04T14:25:58Z DEBUG member 2024-12-04T14:25:58Z DEBUG memberUser 2024-12-04T14:25:58Z DEBUG memberHost 2024-12-04T14:25:58Z DEBUG ipaOwner 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG memberof plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG memberof 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG memberof_postop_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmemberof-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpostoperation', current value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG MemberOf Plugin 2024-12-04T14:25:58Z DEBUG memberofattr: 2024-12-04T14:25:58Z DEBUG memberOf 2024-12-04T14:25:58Z DEBUG memberofentryscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG memberofgroupattr: 2024-12-04T14:25:58Z DEBUG member 2024-12-04T14:25:58Z DEBUG memberUser 2024-12-04T14:25:58Z DEBUG memberHost 2024-12-04T14:25:58Z DEBUG ipaOwner 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG memberof plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG memberof 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG memberof_postop_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmemberof-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG AES 2024-12-04T14:25:58Z DEBUG Class of Service 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Multi-supplier Replication Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG replication-multisupplier 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG replication_multisupplier_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libreplication-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginbetxn to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG AES 2024-12-04T14:25:58Z DEBUG Class of Service 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Multi-supplier Replication Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG replication-multisupplier 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG replication_multisupplier_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libreplication-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=PAM Pass Through Auth,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=PAM Pass Through Auth,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG PAM Pass Through Auth 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG pam_passthruauth_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libpam-passthru-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginloadglobal: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG pamConfig 2024-12-04T14:25:58Z DEBUG pamExcludeSuffix: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG pamFallback: 2024-12-04T14:25:58Z DEBUG FALSE 2024-12-04T14:25:58Z DEBUG pamIDAttr: 2024-12-04T14:25:58Z DEBUG notUsedWithRDNMethod 2024-12-04T14:25:58Z DEBUG pamIDMapMethod: 2024-12-04T14:25:58Z DEBUG RDN 2024-12-04T14:25:58Z DEBUG pamMissingSuffix: 2024-12-04T14:25:58Z DEBUG ALLOW 2024-12-04T14:25:58Z DEBUG pamSecure: 2024-12-04T14:25:58Z DEBUG TRUE 2024-12-04T14:25:58Z DEBUG pamService: 2024-12-04T14:25:58Z DEBUG ldapserver 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpreoperation', current value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpreoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=PAM Pass Through Auth,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG PAM Pass Through Auth 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG pam_passthruauth_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libpam-passthru-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginloadglobal: 2024-12-04T14:25:58Z DEBUG true 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG pamConfig 2024-12-04T14:25:58Z DEBUG pamExcludeSuffix: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG pamFallback: 2024-12-04T14:25:58Z DEBUG FALSE 2024-12-04T14:25:58Z DEBUG pamIDAttr: 2024-12-04T14:25:58Z DEBUG notUsedWithRDNMethod 2024-12-04T14:25:58Z DEBUG pamIDMapMethod: 2024-12-04T14:25:58Z DEBUG RDN 2024-12-04T14:25:58Z DEBUG pamMissingSuffix: 2024-12-04T14:25:58Z DEBUG ALLOW 2024-12-04T14:25:58Z DEBUG pamSecure: 2024-12-04T14:25:58Z DEBUG TRUE 2024-12-04T14:25:58Z DEBUG pamService: 2024-12-04T14:25:58Z DEBUG ldapserver 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG referential integrity postoperation 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG referential integrity plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG referint 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG referint_postop_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libreferint-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:25:58Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG referint-logfile: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:25:58Z DEBUG referint-membership-attr: 2024-12-04T14:25:58Z DEBUG member 2024-12-04T14:25:58Z DEBUG uniquemember 2024-12-04T14:25:58Z DEBUG owner 2024-12-04T14:25:58Z DEBUG seeAlso 2024-12-04T14:25:58Z DEBUG manager 2024-12-04T14:25:58Z DEBUG secretary 2024-12-04T14:25:58Z DEBUG memberuser 2024-12-04T14:25:58Z DEBUG memberhost 2024-12-04T14:25:58Z DEBUG sourcehost 2024-12-04T14:25:58Z DEBUG memberservice 2024-12-04T14:25:58Z DEBUG managedby 2024-12-04T14:25:58Z DEBUG memberallowcmd 2024-12-04T14:25:58Z DEBUG memberdenycmd 2024-12-04T14:25:58Z DEBUG ipasudorunas 2024-12-04T14:25:58Z DEBUG ipasudorunasgroup 2024-12-04T14:25:58Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:25:58Z DEBUG ipaassignedidview 2024-12-04T14:25:58Z DEBUG ipaallowedtarget 2024-12-04T14:25:58Z DEBUG ipamemberca 2024-12-04T14:25:58Z DEBUG ipamembercertprofile 2024-12-04T14:25:58Z DEBUG ipalocation 2024-12-04T14:25:58Z DEBUG membermanager 2024-12-04T14:25:58Z DEBUG ipaowner 2024-12-04T14:25:58Z DEBUG ipaidpconfiglink 2024-12-04T14:25:58Z DEBUG referint-update-delay: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpostoperation', current value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG referential integrity postoperation 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG referential integrity plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG referint 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG referint_postop_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libreferint-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:25:58Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG referint-logfile: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:25:58Z DEBUG referint-membership-attr: 2024-12-04T14:25:58Z DEBUG member 2024-12-04T14:25:58Z DEBUG uniquemember 2024-12-04T14:25:58Z DEBUG owner 2024-12-04T14:25:58Z DEBUG seeAlso 2024-12-04T14:25:58Z DEBUG manager 2024-12-04T14:25:58Z DEBUG secretary 2024-12-04T14:25:58Z DEBUG memberuser 2024-12-04T14:25:58Z DEBUG memberhost 2024-12-04T14:25:58Z DEBUG sourcehost 2024-12-04T14:25:58Z DEBUG memberservice 2024-12-04T14:25:58Z DEBUG managedby 2024-12-04T14:25:58Z DEBUG memberallowcmd 2024-12-04T14:25:58Z DEBUG memberdenycmd 2024-12-04T14:25:58Z DEBUG ipasudorunas 2024-12-04T14:25:58Z DEBUG ipasudorunasgroup 2024-12-04T14:25:58Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:25:58Z DEBUG ipaassignedidview 2024-12-04T14:25:58Z DEBUG ipaallowedtarget 2024-12-04T14:25:58Z DEBUG ipamemberca 2024-12-04T14:25:58Z DEBUG ipamembercertprofile 2024-12-04T14:25:58Z DEBUG ipalocation 2024-12-04T14:25:58Z DEBUG membermanager 2024-12-04T14:25:58Z DEBUG ipaowner 2024-12-04T14:25:58Z DEBUG ipaidpconfiglink 2024-12-04T14:25:58Z DEBUG referint-update-delay: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Roles Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:58Z DEBUG State Change Plugin 2024-12-04T14:25:58Z DEBUG Views 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG roles plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG roles 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG roles_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libroles-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginbetxn to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Roles Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:58Z DEBUG State Change Plugin 2024-12-04T14:25:58Z DEBUG Views 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG roles plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG roles 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG roles_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libroles-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG State Change Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG state change notification service plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG statechange 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG statechange_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libstatechange-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginType to 'betxnpostoperation', current value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG State Change Plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG state change notification service plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG statechange 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG statechange_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libstatechange-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=USN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=USN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG USN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG USN (Update Sequence Number) plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG USN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG usn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libusn-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginbetxn to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=USN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG USN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG USN (Update Sequence Number) plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG USN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG usn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libusn-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA MODRDN plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipamodrdn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_modrdn 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG Red Hat, Inc. 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-plugintype to 'betxnpostoperation', current value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG only: updated value ['betxnpostoperation'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=IPA MODRDN,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA MODRDN plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA MODRDN 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipamodrdn_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_modrdn 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpostoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG Red Hat, Inc. 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA Password Extended Operation plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA Password Manager 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipapwd_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG extendedop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 49 2024-12-04T14:25:58Z DEBUG nsslapd-realmtree: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginbetxn to 'on', current value ['on'] 2024-12-04T14:25:58Z DEBUG only: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA Password Extended Operation plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA Password Manager 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipapwd_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG extendedop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 49 2024-12-04T14:25:58Z DEBUG nsslapd-realmtree: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Schema Compatibility 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG schema_compat_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG onlyifexist: 'on' to nsslapd-pluginbetxn, current value ['on'] 2024-12-04T14:25:58Z DEBUG onlyifexist: set nsslapd-pluginbetxn to ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Schema Compatibility 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG schema_compat_plugin_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG object 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG none 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG New entry: cn=NIS Server,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=NIS Server,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG onlyifexist: 'on' to nsslapd-pluginbetxn, current value [] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=NIS Server,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-enable-betxn.update 0.067 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-ipapwd.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA Password Extended Operation plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA Password Manager 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipapwd_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG extendedop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 49 2024-12-04T14:25:58Z DEBUG nsslapd-realmtree: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG add: '49' to nsslapd-pluginprecedence, current value ['49'] 2024-12-04T14:25:58Z DEBUG add: updated value ['49'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ipa_pwd_extop,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG IPA Password Extended Operation plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG IPA Password Manager 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG ipapwd_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libipa_pwd_extop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG extendedop 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG FreeIPA project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG FreeIPA/1.0 2024-12-04T14:25:58Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:58Z DEBUG 49 2024-12-04T14:25:58Z DEBUG nsslapd-realmtree: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-ipapwd.update 0.004 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-rootdse.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG namingContexts: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=changelog 2024-12-04T14:25:58Z DEBUG o=ipaca 2024-12-04T14:25:58Z DEBUG defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG supportedExtension: 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.8 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.10 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4.2 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.11.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.9 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.8 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.11.3 2024-12-04T14:25:58Z DEBUG supportedControl: 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.2 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.5 2024-12-04T14:25:58Z DEBUG 1.2.840.113556.1.4.473 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.9 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.16 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.15 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.17 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.19 2024-12-04T14:25:58Z DEBUG 1.3.6.1.1.13.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.1.13.2 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.8.5.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.10.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.9.5.2 2024-12-04T14:25:58Z DEBUG 1.2.840.113556.1.4.319 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.9.5.8 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.666.5.16 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.14 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.20 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.1466.29539.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.18 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.13 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.9.1.1 2024-12-04T14:25:58Z DEBUG supportedSASLMechanisms: 2024-12-04T14:25:58Z DEBUG EXTERNAL 2024-12-04T14:25:58Z DEBUG SRP 2024-12-04T14:25:58Z DEBUG SCRAM-SHA-1 2024-12-04T14:25:58Z DEBUG GS2-KRB5 2024-12-04T14:25:58Z DEBUG GS2-IAKERB 2024-12-04T14:25:58Z DEBUG GSSAPI 2024-12-04T14:25:58Z DEBUG GSS-SPNEGO 2024-12-04T14:25:58Z DEBUG DIGEST-MD5 2024-12-04T14:25:58Z DEBUG OTP 2024-12-04T14:25:58Z DEBUG NTLM 2024-12-04T14:25:58Z DEBUG CRAM-MD5 2024-12-04T14:25:58Z DEBUG PLAIN 2024-12-04T14:25:58Z DEBUG LOGIN 2024-12-04T14:25:58Z DEBUG ANONYMOUS 2024-12-04T14:25:58Z DEBUG supportedLDAPVersion: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG vendorName: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG vendorVersion: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 B2024.233.1009 2024-12-04T14:25:58Z DEBUG dataversion: 2024-12-04T14:25:58Z DEBUG 020241204142550020241204142550020241204142550 2024-12-04T14:25:58Z DEBUG netscapemdsuffix: 2024-12-04T14:25:58Z DEBUG cn=ldap://dc=dc,dc=freeipa,dc=testdomain:0 2024-12-04T14:25:58Z DEBUG lastusn: 2024-12-04T14:25:58Z DEBUG 1858 2024-12-04T14:25:58Z DEBUG changeLog: 2024-12-04T14:25:58Z DEBUG cn=changelog 2024-12-04T14:25:58Z DEBUG firstchangenumber: 2024-12-04T14:25:58Z DEBUG 107 2024-12-04T14:25:58Z DEBUG lastchangenumber: 2024-12-04T14:25:58Z DEBUG 109 2024-12-04T14:25:58Z DEBUG ipatopologypluginversion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG ipatopologyismanaged: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG ipaDomainLevel: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "rootdse anon read access"; allow(read,search,compare) userdn="ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: 'namingContexts' to nsslapd-return-default-opattr, current value [] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts'] 2024-12-04T14:25:58Z DEBUG add: 'supportedControl' to nsslapd-return-default-opattr, current value ['namingContexts'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl'] 2024-12-04T14:25:58Z DEBUG add: 'supportedExtension' to nsslapd-return-default-opattr, current value ['namingContexts', 'supportedControl'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl', 'supportedExtension'] 2024-12-04T14:25:58Z DEBUG add: 'supportedLDAPVersion' to nsslapd-return-default-opattr, current value ['namingContexts', 'supportedControl', 'supportedExtension'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion'] 2024-12-04T14:25:58Z DEBUG add: 'supportedSASLMechanisms' to nsslapd-return-default-opattr, current value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms'] 2024-12-04T14:25:58Z DEBUG add: 'vendorName' to nsslapd-return-default-opattr, current value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms', 'vendorName'] 2024-12-04T14:25:58Z DEBUG add: 'vendorVersion' to nsslapd-return-default-opattr, current value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms', 'vendorName'] 2024-12-04T14:25:58Z DEBUG add: updated value ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms', 'vendorName', 'vendorVersion'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG namingContexts: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=changelog 2024-12-04T14:25:58Z DEBUG o=ipaca 2024-12-04T14:25:58Z DEBUG defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG supportedExtension: 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.8 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.10 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.4.2 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.11.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.1 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.9 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.5.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.5 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.6.8 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.11.3 2024-12-04T14:25:58Z DEBUG supportedControl: 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.2 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.3 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.4 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.5 2024-12-04T14:25:58Z DEBUG 1.2.840.113556.1.4.473 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.9 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.16 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.15 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.17 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.19 2024-12-04T14:25:58Z DEBUG 1.3.6.1.1.13.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.1.13.2 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.8.5.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.10.1 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.9.5.2 2024-12-04T14:25:58Z DEBUG 1.2.840.113556.1.4.319 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.42.2.27.9.5.8 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.666.5.16 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.6 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.8.10.7 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.14 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.20 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.1466.29539.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.12 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.18 2024-12-04T14:25:58Z DEBUG 2.16.840.1.113730.3.4.13 2024-12-04T14:25:58Z DEBUG 1.3.6.1.4.1.4203.1.9.1.1 2024-12-04T14:25:58Z DEBUG supportedSASLMechanisms: 2024-12-04T14:25:58Z DEBUG EXTERNAL 2024-12-04T14:25:58Z DEBUG SRP 2024-12-04T14:25:58Z DEBUG SCRAM-SHA-1 2024-12-04T14:25:58Z DEBUG GS2-KRB5 2024-12-04T14:25:58Z DEBUG GS2-IAKERB 2024-12-04T14:25:58Z DEBUG GSSAPI 2024-12-04T14:25:58Z DEBUG GSS-SPNEGO 2024-12-04T14:25:58Z DEBUG DIGEST-MD5 2024-12-04T14:25:58Z DEBUG OTP 2024-12-04T14:25:58Z DEBUG NTLM 2024-12-04T14:25:58Z DEBUG CRAM-MD5 2024-12-04T14:25:58Z DEBUG PLAIN 2024-12-04T14:25:58Z DEBUG LOGIN 2024-12-04T14:25:58Z DEBUG ANONYMOUS 2024-12-04T14:25:58Z DEBUG supportedLDAPVersion: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG vendorName: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG vendorVersion: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 B2024.233.1009 2024-12-04T14:25:58Z DEBUG dataversion: 2024-12-04T14:25:58Z DEBUG 020241204142550020241204142550020241204142550 2024-12-04T14:25:58Z DEBUG netscapemdsuffix: 2024-12-04T14:25:58Z DEBUG cn=ldap://dc=dc,dc=freeipa,dc=testdomain:0 2024-12-04T14:25:58Z DEBUG lastusn: 2024-12-04T14:25:58Z DEBUG 1858 2024-12-04T14:25:58Z DEBUG changeLog: 2024-12-04T14:25:58Z DEBUG cn=changelog 2024-12-04T14:25:58Z DEBUG firstchangenumber: 2024-12-04T14:25:58Z DEBUG 107 2024-12-04T14:25:58Z DEBUG lastchangenumber: 2024-12-04T14:25:58Z DEBUG 109 2024-12-04T14:25:58Z DEBUG ipatopologypluginversion: 2024-12-04T14:25:58Z DEBUG 1.0 2024-12-04T14:25:58Z DEBUG ipatopologyismanaged: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG ipaDomainLevel: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr != "aci")(version 3.0; aci "rootdse anon read access"; allow(read,search,compare) userdn="ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG nsslapd-return-default-opattr: 2024-12-04T14:25:58Z DEBUG namingContexts 2024-12-04T14:25:58Z DEBUG supportedControl 2024-12-04T14:25:58Z DEBUG supportedExtension 2024-12-04T14:25:58Z DEBUG supportedLDAPVersion 2024-12-04T14:25:58Z DEBUG supportedSASLMechanisms 2024-12-04T14:25:58Z DEBUG vendorName 2024-12-04T14:25:58Z DEBUG vendorVersion 2024-12-04T14:25:58Z DEBUG [(2, 'nsslapd-return-default-opattr', ['namingContexts', 'supportedControl', 'supportedExtension', 'supportedLDAPVersion', 'supportedSASLMechanisms', 'vendorName', 'vendorVersion'])] 2024-12-04T14:25:58Z DEBUG Updated 1 2024-12-04T14:25:58Z DEBUG update_entry modlist [(2, 'nsslapd-return-default-opattr', [b'namingContexts', b'supportedControl', b'supportedExtension', b'supportedLDAPVersion', b'supportedSASLMechanisms', b'vendorName', b'vendorVersion'])] 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-rootdse.update 0.037 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-selinuxusermap.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG selinux 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG selinux 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=usermap,cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=usermap,cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG usermap 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Add SELinux User Maps";allow (add) groupdn = "ldap:///cn=System: Add SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || ipaenabledflag || ipaselinuxuser || memberhost || memberuser || seealso")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Modify SELinux User Maps";allow (write) groupdn = "ldap:///cn=System: Modify SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "accesstime || cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipaselinuxuser || ipauniqueid || member || memberhost || memberuser || modifytimestamp || objectclass || seealso || usercategory")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Read SELinux User Maps";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Remove SELinux User Maps";allow (delete) groupdn = "ldap:///cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=usermap,cn=selinux,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG usermap 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Add SELinux User Maps";allow (add) groupdn = "ldap:///cn=System: Add SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || ipaenabledflag || ipaselinuxuser || memberhost || memberuser || seealso")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Modify SELinux User Maps";allow (write) groupdn = "ldap:///cn=System: Modify SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "accesstime || cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipaselinuxuser || ipauniqueid || member || memberhost || memberuser || modifytimestamp || objectclass || seealso || usercategory")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Read SELinux User Maps";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Remove SELinux User Maps";allow (delete) groupdn = "ldap:///cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-selinuxusermap.update 0.005 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/10-uniqueness.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=sudorule name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=sudorule name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG sudorule name uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=sudorules,cn=sudo,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=sudorule name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG sudorule name uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=sudorules,cn=sudo,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=certificate store subject uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=certificate store subject uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG certificate store subject uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaCertSubject 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=certificate store subject uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG certificate store subject uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaCertSubject 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=certificate store issuer/serial uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=certificate store issuer/serial uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG certificate store issuer/serial uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaCertIssuerSerial 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=certificate store issuer/serial uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG certificate store issuer/serial uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaCertIssuerSerial 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG uid uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG posixAccount 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG uid uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG posixAccount 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG uid uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG posixAccount 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG add: 'cn=compat,dc=freeipa,dc=testdomain' to uniqueness-exclude-subtrees, current value ['cn=compat,dc=freeipa,dc=testdomain', 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain' to uniqueness-exclude-subtrees, current value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['cn=compat,dc=freeipa,dc=testdomain', 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG remove: 'off' from uniqueness-across-all-subtrees, current value ['on'] 2024-12-04T14:25:58Z DEBUG remove: 'off' not in uniqueness-across-all-subtrees 2024-12-04T14:25:58Z DEBUG add: 'on' to uniqueness-across-all-subtrees, current value ['on'] 2024-12-04T14:25:58Z DEBUG add: updated value ['on'] 2024-12-04T14:25:58Z DEBUG add: 'posixAccount' to uniqueness-subtree-entries-oc, current value ['posixAccount'] 2024-12-04T14:25:58Z DEBUG add: updated value ['posixAccount'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=uid uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG uid uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG uid 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG posixAccount 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=krbPrincipalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=krbPrincipalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG krbPrincipalName uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG krbPrincipalName 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG add: 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain' to uniqueness-exclude-subtrees, current value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: 'on' to uniqueness-across-all-subtrees, current value ['on'] 2024-12-04T14:25:58Z DEBUG add: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=krbPrincipalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG krbPrincipalName uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG krbPrincipalName 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=krbCanonicalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=krbCanonicalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG krbCanonicalName uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG krbCanonicalName 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG add: 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain' to uniqueness-exclude-subtrees, current value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: 'on' to uniqueness-across-all-subtrees, current value ['on'] 2024-12-04T14:25:58Z DEBUG add: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=krbCanonicalName uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG krbCanonicalName uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG krbCanonicalName 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ipaUniqueID uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ipaUniqueID uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipaUniqueID uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaUniqueID 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG add: 'cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain' to uniqueness-exclude-subtrees, current value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: updated value ['cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG add: 'on' to uniqueness-across-all-subtrees, current value ['on'] 2024-12-04T14:25:58Z DEBUG add: updated value ['on'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ipaUniqueID uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipaUniqueID uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaUniqueID 2024-12-04T14:25:58Z DEBUG uniqueness-exclude-subtrees: 2024-12-04T14:25:58Z DEBUG cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=caacl name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=caacl name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG caacl name uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=caacls,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=caacl name uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG caacl name uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG cn 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=caacls,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ipaSubordinateIdEntry ipaOwner uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ipaSubordinateIdEntry ipaOwner uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipaSubordinateIdEntry ipaOwner uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaOwner 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG ipaSubordinateIdEntry 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ipaSubordinateIdEntry ipaOwner uniqueness,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ipaSubordinateIdEntry ipaOwner uniqueness 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Enforce unique attribute values 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG NSUniqueAttr_Init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libattr-unique-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG preoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG uniqueness-across-all-subtrees: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG uniqueness-attribute-name: 2024-12-04T14:25:58Z DEBUG ipaOwner 2024-12-04T14:25:58Z DEBUG uniqueness-subtree-entries-oc: 2024-12-04T14:25:58Z DEBUG ipaSubordinateIdEntry 2024-12-04T14:25:58Z DEBUG uniqueness-subtrees: 2024-12-04T14:25:58Z DEBUG cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/10-uniqueness.update 0.047 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/19-managed-entries.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Managed Entries plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG mep_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG only: set nsslapd-pluginConfigArea to 'cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain', current value ['cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG only: updated value ['cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:58Z DEBUG database 2024-12-04T14:25:58Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:58Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:58Z DEBUG Managed Entries plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:58Z DEBUG mep_init 2024-12-04T14:25:58Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:58Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:58Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:58Z DEBUG betxnpreoperation 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:58Z DEBUG 389 Project 2024-12-04T14:25:58Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:58Z DEBUG 2.4.6 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsSlapdPlugin 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Managed Entries 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Templates 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Templates 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Definitions 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG Definitions 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG LDAP update duration: /usr/share/ipa/updates/19-managed-entries.update 0.010 sec 2024-12-04T14:25:58Z DEBUG Parsing update file '/usr/share/ipa/updates/20-aci.update' 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=ng,cn=alt,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=ng,cn=alt,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ng 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Add Netgroups";allow (add) groupdn = "ldap:///cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "externalhost || member || memberhost || memberuser")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroups";allow (write) groupdn = "ldap:///cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || externalhost || member || memberhost || memberof || memberuser || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroup Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipauniqueid || modifytimestamp || nisdomainname || objectclass || usercategory")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroups";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";)' to aci, current value ['(targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Add Netgroups";allow (add) groupdn = "ldap:///cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "externalhost || member || memberhost || memberuser")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroups";allow (write) groupdn = "ldap:///cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || externalhost || member || memberhost || memberof || memberuser || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipauniqueid || modifytimestamp || nisdomainname || objectclass || usercategory")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroups";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Add Netgroups";allow (add) groupdn = "ldap:///cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "externalhost || member || memberhost || memberuser")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroups";allow (write) groupdn = "ldap:///cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || externalhost || member || memberhost || memberof || memberuser || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipauniqueid || modifytimestamp || nisdomainname || objectclass || usercategory")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroups";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=ng,cn=alt,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG ng 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Add Netgroups";allow (add) groupdn = "ldap:///cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "externalhost || member || memberhost || memberuser")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Modify Netgroups";allow (write) groupdn = "ldap:///cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || externalhost || member || memberhost || memberof || memberuser || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroup Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipauniqueid || modifytimestamp || nisdomainname || objectclass || usercategory")(targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Read Netgroups";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG accounts 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG accounts 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG computers 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";)' to aci, current value ['(targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG computers 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG computers 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)' to aci, current value ['(targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG computers 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr="usercertificate || krblastpwdchange || description || l || nshostlocation || nshardwareplatform || nsosversion")(version 3.0; acl "Hosts can modify their own certs and keytabs"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can modify their own SSH public keys"; allow(write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage other host Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other host SSH public keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG replicas 2024-12-04T14:25:58Z DEBUG remove: '(targetfilter="(objectclass=nsContainer)")(version 3.0; acl "Deny read access to replica configuration"; deny(read, search, compare) userdn = "ldap:///anyone";)' from aci, current value [] 2024-12-04T14:25:58Z DEBUG remove: '(targetfilter="(objectclass=nsContainer)")(version 3.0; acl "Deny read access to replica configuration"; deny(read, search, compare) userdn = "ldap:///anyone";)' not in aci 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG replicas 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG masters 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG sysaccounts 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG nsContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG sysaccounts 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG krbContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG kerberos 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";)' to aci, current value ['(targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG krbContainer 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG kerberos 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || krbTicketFlags || ipaUniqueId || memberOf || serverHostName || enrolledBy")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || krbTicketFlags || ipaUniqueId || memberOf || serverHostName || enrolledBy")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || krbTicketFlags || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || krbTicketFlags || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG add: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG domain 2024-12-04T14:25:58Z DEBUG pilotObject 2024-12-04T14:25:58Z DEBUG domainRelatedObject 2024-12-04T14:25:58Z DEBUG nisDomainObject 2024-12-04T14:25:58Z DEBUG dc: 2024-12-04T14:25:58Z DEBUG freeipa 2024-12-04T14:25:58Z DEBUG info: 2024-12-04T14:25:58Z DEBUG IPA V2.0 2024-12-04T14:25:58Z DEBUG nisDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG associatedDomain: 2024-12-04T14:25:58Z DEBUG freeipa.testdomain 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:58Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:58Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=tasks,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=tasks,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG tasks 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG remove: 'aci: (targetattr=*)(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from add, current value [] 2024-12-04T14:25:58Z DEBUG remove: 'aci: (targetattr=*)(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in add 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=tasks,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG tasks 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(target = "ldap:///cn=*,cn=automember rebuild membership,cn=tasks,cn=config")(version 3.0;acl "permission:System: Read Automember Tasks";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (read, compare, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG mapping tree 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG add: '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG mapping tree 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG mapping tree 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG add: updated value ['(target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG mapping tree 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (target = "ldap:///cn=meTo($dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastinitstatusjson || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalastupdatestatusjson || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=dc\=freeipa\,dc\=testdomain,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=dc\=freeipa\,dc\=testdomain,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG dc\=freeipa\,dc\=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-backend: 2024-12-04T14:25:58Z DEBUG userRoot 2024-12-04T14:25:58Z DEBUG nsslapd-state: 2024-12-04T14:25:58Z DEBUG backend 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsMappingTree 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value [] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value [] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value [] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=dc\=freeipa\,dc\=testdomain,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG dc\=freeipa\,dc\=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-backend: 2024-12-04T14:25:58Z DEBUG userRoot 2024-12-04T14:25:58Z DEBUG nsslapd-state: 2024-12-04T14:25:58Z DEBUG backend 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsMappingTree 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG o=ipaca 2024-12-04T14:25:58Z DEBUG nsslapd-backend: 2024-12-04T14:25:58Z DEBUG ipaca 2024-12-04T14:25:58Z DEBUG nsslapd-state: 2024-12-04T14:25:58Z DEBUG Backend 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsMappingTree 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)'] 2024-12-04T14:25:58Z DEBUG remove: '(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Final value after applying updates 2024-12-04T14:25:58Z DEBUG dn: cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG o=ipaca 2024-12-04T14:25:58Z DEBUG nsslapd-backend: 2024-12-04T14:25:58Z DEBUG ipaca 2024-12-04T14:25:58Z DEBUG nsslapd-state: 2024-12-04T14:25:58Z DEBUG Backend 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsMappingTree 2024-12-04T14:25:58Z DEBUG aci: 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:58Z DEBUG [] 2024-12-04T14:25:58Z DEBUG Updated 0 2024-12-04T14:25:58Z DEBUG Done 2024-12-04T14:25:58Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:58Z DEBUG --------------------------------------------- 2024-12-04T14:25:58Z DEBUG Initial value 2024-12-04T14:25:58Z DEBUG dn: cn=config 2024-12-04T14:25:58Z DEBUG cn: 2024-12-04T14:25:58Z DEBUG config 2024-12-04T14:25:58Z DEBUG objectClass: 2024-12-04T14:25:58Z DEBUG top 2024-12-04T14:25:58Z DEBUG extensibleObject 2024-12-04T14:25:58Z DEBUG nsslapdConfig 2024-12-04T14:25:58Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:58Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-betype: 2024-12-04T14:25:58Z DEBUG ldbm database 2024-12-04T14:25:58Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:58Z DEBUG cn=schema 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-plugin: 2024-12-04T14:25:58Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:58Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:58Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:58Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 10 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:58Z DEBUG 16384 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-port: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-localuser: 2024-12-04T14:25:58Z DEBUG dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordInHistory: 2024-12-04T14:25:58Z DEBUG 6 2024-12-04T14:25:58Z DEBUG passwordUnlock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordGraceLimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG passwordMustChange: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:58Z DEBUG 100000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordWarning: 2024-12-04T14:25:58Z DEBUG 86400 2024-12-04T14:25:58Z DEBUG nsslapd-readonly: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:58Z DEBUG 16 2024-12-04T14:25:58Z DEBUG passwordLockout: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-localhost: 2024-12-04T14:25:58Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:58Z DEBUG 10000 2024-12-04T14:25:58Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:58Z DEBUG 40 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG passwordMinLength: 2024-12-04T14:25:58Z DEBUG 8 2024-12-04T14:25:58Z DEBUG passwordMinDigits: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinAlphas: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinUppers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinLowers: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinSpecials: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMin8bit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMinCategories: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG passwordPalindrome: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictCheck: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordDictPath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordUserAttributes: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordBadWords: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordMaxSequence: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:58Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:58Z DEBUG replication-only 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:58Z DEBUG 500 2024-12-04T14:25:58Z DEBUG passwordMaxFailure: 2024-12-04T14:25:58Z DEBUG 3 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:58Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-security: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordMaxAge: 2024-12-04T14:25:58Z DEBUG 8640000 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:58Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:58Z DEBUG passwordChange: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:58Z DEBUG 256 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG week 2024-12-04T14:25:58Z DEBUG nsslapd-securePort: 2024-12-04T14:25:58Z DEBUG 636 2024-12-04T14:25:58Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:58Z DEBUG 223 2024-12-04T14:25:58Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG passwordExp: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:58Z DEBUG day 2024-12-04T14:25:58Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:58Z DEBUG 100 2024-12-04T14:25:58Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:58Z DEBUG 3600 2024-12-04T14:25:58Z DEBUG nsslapd-nagle: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:58Z DEBUG month 2024-12-04T14:25:58Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:58Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:58Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:58Z DEBUG uidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:58Z DEBUG gidNumber 2024-12-04T14:25:58Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:58Z DEBUG dc=example,dc=com 2024-12-04T14:25:58Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:58Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:58Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-counters: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:58Z DEBUG 2 2024-12-04T14:25:58Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:58Z DEBUG 5 2024-12-04T14:25:58Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:58Z DEBUG cn=Directory Manager 2024-12-04T14:25:58Z DEBUG passwordMinAge: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:58Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:58Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:58Z DEBUG 209715200 2024-12-04T14:25:58Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:58Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:58Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:58Z DEBUG 524288 2024-12-04T14:25:58Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:58Z DEBUG allowed 2024-12-04T14:25:58Z DEBUG nsslapd-config: 2024-12-04T14:25:58Z DEBUG cn=config 2024-12-04T14:25:58Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:58Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:58Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:58Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:58Z DEBUG /tmp 2024-12-04T14:25:58Z DEBUG nsslapd-certdir: 2024-12-04T14:25:58Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:58Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:58Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:58Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:58Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-rundir: 2024-12-04T14:25:58Z DEBUG /run/dirsrv 2024-12-04T14:25:58Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:58Z DEBUG 300000 2024-12-04T14:25:58Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-localssf: 2024-12-04T14:25:58Z DEBUG 71 2024-12-04T14:25:58Z DEBUG nsslapd-minssf: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:58Z DEBUG next 2024-12-04T14:25:58Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:58Z DEBUG warn 2024-12-04T14:25:58Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:58Z DEBUG 0 2024-12-04T14:25:58Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:58Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:58Z DEBUG 60 2024-12-04T14:25:58Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:58Z DEBUG 20971520 2024-12-04T14:25:58Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:58Z DEBUG 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:58Z DEBUG nolog 2024-12-04T14:25:58Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:58Z DEBUG 2097152 2024-12-04T14:25:58Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:58Z DEBUG 1 2024-12-04T14:25:58Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:58Z DEBUG 128 2024-12-04T14:25:58Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:58Z DEBUG -10 2024-12-04T14:25:58Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:58Z DEBUG on 2024-12-04T14:25:58Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:58Z DEBUG -1 2024-12-04T14:25:58Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:58Z DEBUG 600 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:58Z DEBUG off 2024-12-04T14:25:58Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:59Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:59Z DEBUG dirsrv-log 2024-12-04T14:25:59Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:59Z DEBUG process-safe 2024-12-04T14:25:59Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:59Z DEBUG 30 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordStorageScheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG passwordAdminDN: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:59Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr != aci)(version 3.0; aci "replica admins read access"; allow (read, search, compare) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr != aci)(version 3.0; aci "replica admins read access"; allow (read, search, compare) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:System: Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:System: Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG config 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsslapdConfig 2024-12-04T14:25:59Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:59Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-betype: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:59Z DEBUG cn=schema 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-plugin: 2024-12-04T14:25:59Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:59Z DEBUG 16384 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-port: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-localuser: 2024-12-04T14:25:59Z DEBUG dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordInHistory: 2024-12-04T14:25:59Z DEBUG 6 2024-12-04T14:25:59Z DEBUG passwordUnlock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordGraceLimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordMustChange: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:59Z DEBUG 100000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordWarning: 2024-12-04T14:25:59Z DEBUG 86400 2024-12-04T14:25:59Z DEBUG nsslapd-readonly: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:59Z DEBUG 16 2024-12-04T14:25:59Z DEBUG passwordLockout: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-localhost: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:59Z DEBUG 10000 2024-12-04T14:25:59Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:59Z DEBUG 40 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordMinLength: 2024-12-04T14:25:59Z DEBUG 8 2024-12-04T14:25:59Z DEBUG passwordMinDigits: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinAlphas: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinUppers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinLowers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinSpecials: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMin8bit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinCategories: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordPalindrome: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictCheck: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictPath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordUserAttributes: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordBadWords: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordMaxSequence: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:59Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:59Z DEBUG replication-only 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG passwordMaxFailure: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:59Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-security: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordMaxAge: 2024-12-04T14:25:59Z DEBUG 8640000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:59Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:59Z DEBUG passwordChange: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securePort: 2024-12-04T14:25:59Z DEBUG 636 2024-12-04T14:25:59Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:59Z DEBUG 223 2024-12-04T14:25:59Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordExp: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG day 2024-12-04T14:25:59Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-nagle: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:59Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:59Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:59Z DEBUG uidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:59Z DEBUG gidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:59Z DEBUG dc=example,dc=com 2024-12-04T14:25:59Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:59Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:59Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-counters: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG passwordMinAge: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:59Z DEBUG 209715200 2024-12-04T14:25:59Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:59Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:59Z DEBUG 524288 2024-12-04T14:25:59Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:59Z DEBUG allowed 2024-12-04T14:25:59Z DEBUG nsslapd-config: 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:59Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:59Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:59Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:59Z DEBUG /tmp 2024-12-04T14:25:59Z DEBUG nsslapd-certdir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:59Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:59Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rundir: 2024-12-04T14:25:59Z DEBUG /run/dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:59Z DEBUG 300000 2024-12-04T14:25:59Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-localssf: 2024-12-04T14:25:59Z DEBUG 71 2024-12-04T14:25:59Z DEBUG nsslapd-minssf: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:59Z DEBUG next 2024-12-04T14:25:59Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:59Z DEBUG warn 2024-12-04T14:25:59Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:59Z DEBUG 60 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:59Z DEBUG 20971520 2024-12-04T14:25:59Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:59Z DEBUG nolog 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:59Z DEBUG 128 2024-12-04T14:25:59Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:59Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:59Z DEBUG dirsrv-log 2024-12-04T14:25:59Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:59Z DEBUG process-safe 2024-12-04T14:25:59Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:59Z DEBUG 30 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordStorageScheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG passwordAdminDN: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:59Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(target = "ldap:///cn=*,cn=roles,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0; acl "No anonymous access to roles"; deny (read,search,compare) userdn != "ldap:///all";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(target = "ldap:///cn=*,cn=roles,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0; acl "No anonymous access to roles"; deny (read,search,compare) userdn != "ldap:///all";)' not in aci 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "memberOf || memberHost || memberUser")(version 3.0; acl "No anonymous access to member information"; deny (read,search,compare) userdn != "ldap:///all";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "memberOf || memberHost || memberUser")(version 3.0; acl "No anonymous access to member information"; deny (read,search,compare) userdn != "ldap:///all";)' not in aci 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(target = "ldap:///cn=*,ou=SUDOers,dc=freeipa,dc=testdomain")(version 3.0; acl "No anonymous access to sudo"; deny (read,search,compare) userdn != "ldap:///all";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(target = "ldap:///cn=*,ou=SUDOers,dc=freeipa,dc=testdomain")(version 3.0; acl "No anonymous access to sudo"; deny (read,search,compare) userdn != "ldap:///all";)' not in aci 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hbac 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Add HBAC Rule";allow (add) groupdn = "ldap:///cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Delete HBAC Rule";allow (delete) groupdn = "ldap:///cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "externalhost || memberhost || memberservice || memberuser")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Manage HBAC Rule Membership";allow (write) groupdn = "ldap:///cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "accessruletype || accesstime || cn || description || hostcategory || ipaenabledflag || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Modify HBAC Rule";allow (write) groupdn = "ldap:///cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "accessruletype || accesstime || cn || createtimestamp || description || entryusn || externalhost || hostcategory || ipaenabledflag || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Read HBAC Rules";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(version 3.0; acl "No anonymous access to hbac"; deny (read,search,compare) userdn != "ldap:///all";)' from aci, current value ['(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Add HBAC Rule";allow (add) groupdn = "ldap:///cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Delete HBAC Rule";allow (delete) groupdn = "ldap:///cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "externalhost || memberhost || memberservice || memberuser")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Manage HBAC Rule Membership";allow (write) groupdn = "ldap:///cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "accessruletype || accesstime || cn || description || hostcategory || ipaenabledflag || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Modify HBAC Rule";allow (write) groupdn = "ldap:///cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "accessruletype || accesstime || cn || createtimestamp || description || entryusn || externalhost || hostcategory || ipaenabledflag || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Read HBAC Rules";allow (compare,read,search) userdn = "ldap:///all";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(version 3.0; acl "No anonymous access to hbac"; deny (read,search,compare) userdn != "ldap:///all";)' not in aci 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hbac 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Add HBAC Rule";allow (add) groupdn = "ldap:///cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Delete HBAC Rule";allow (delete) groupdn = "ldap:///cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "externalhost || memberhost || memberservice || memberuser")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Manage HBAC Rule Membership";allow (write) groupdn = "ldap:///cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "accessruletype || accesstime || cn || description || hostcategory || ipaenabledflag || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Modify HBAC Rule";allow (write) groupdn = "ldap:///cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "accessruletype || accesstime || cn || createtimestamp || description || entryusn || externalhost || hostcategory || ipaenabledflag || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Read HBAC Rules";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=sudo,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=sudo,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sudo 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(version 3.0; acl "No anonymous access to sudo"; deny (read,search,compare) userdn != "ldap:///all";)' from aci, current value [] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "*")(version 3.0; acl "No anonymous access to sudo"; deny (read,search,compare) userdn != "ldap:///all";)' not in aci 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=sudo,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sudo 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG accounts 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG accounts 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG add: '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG groups 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member || memberhost || memberof || memberuid || memberuser")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Group Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN";)' from aci, current value ['(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)', '(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "member || memberhost || memberof || memberuid || memberuser")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN";)' not in aci 2024-12-04T14:25:59Z DEBUG add: '(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)' to aci, current value ['(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)', '(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "member || memberhost || memberof || memberuid || memberuser")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "member || memberhost || memberof || memberuid || memberuser")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Group Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG groups 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member || memberhost || memberof || memberuid || memberuser")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Group Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hostgroups 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Add Hostgroups";allow (add) groupdn = "ldap:///cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN";)' from aci, current value ['(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)', '(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Add Hostgroups";allow (add) groupdn = "ldap:///cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN";)' not in aci 2024-12-04T14:25:59Z DEBUG add: '(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)' to aci, current value ['(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)', '(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Add Hostgroups";allow (add) groupdn = "ldap:///cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Add Hostgroups";allow (add) groupdn = "ldap:///cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hostgroups 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Add Hostgroups";allow (add) groupdn = "ldap:///cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG services 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:25:59Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG remove: '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG remove: '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG services 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:25:59Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:25:59Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ranges 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)', '(target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ranges 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sysaccounts 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sysaccounts 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "objectClass || cn")(version 3.0; acl "Allow hosts to read replication managers"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "member")(version 3.0; acl "IPA server hosts can modify replication managers members"; allow(read, search, compare, write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG etc 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaGuiConfig)")(targetattr != "aci")(version 3.0;acl "Admins can change GUI config"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "nsDS5ReplicaId")(version 3.0; acl "IPA server hosts can change replica ID"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantdomainguid || ipantfallbackprimarygroup || ipantflatname || ipantsecurityidentifier || modifytimestamp || objectclass")(target = "ldap:///cn=ad,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipantdomainattrs)")(version 3.0;acl "permission:System: Read AD Domains";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=replication,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "nsDS5ReplicaId")(version 3.0; acl "IPA server hosts can change replica ID"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(objectClass=ipaGuiConfig)")(targetattr != "aci")(version 3.0;acl "Admins can change GUI config"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=replication,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "nsDS5ReplicaId")(version 3.0; acl "IPA server hosts can change replica ID"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantdomainguid || ipantfallbackprimarygroup || ipantflatname || ipantsecurityidentifier || modifytimestamp || objectclass")(target = "ldap:///cn=ad,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipantdomainattrs)")(version 3.0;acl "permission:System: Read AD Domains";allow (compare,read,search) userdn = "ldap:///all";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(objectClass=ipaGuiConfig)")(targetattr != "aci")(version 3.0;acl "Admins can change GUI config"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantdomainguid || ipantfallbackprimarygroup || ipantflatname || ipantsecurityidentifier || modifytimestamp || objectclass")(target = "ldap:///cn=ad,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipantdomainattrs)")(version 3.0;acl "permission:System: Read AD Domains";allow (compare,read,search) userdn = "ldap:///all";)', '(target = "ldap:///cn=replication,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "nsDS5ReplicaId")(version 3.0; acl "IPA server hosts can change replica ID"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG etc 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaGuiConfig)")(targetattr != "aci")(version 3.0;acl "Admins can change GUI config"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantdomainguid || ipantfallbackprimarygroup || ipantflatname || ipantsecurityidentifier || modifytimestamp || objectclass")(target = "ldap:///cn=ad,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipantdomainattrs)")(version 3.0;acl "permission:System: Read AD Domains";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=replication,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "nsDS5ReplicaId")(version 3.0; acl "IPA server hosts can change replica ID"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: krbPrincipalName=WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: krbPrincipalName=WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbprincipal 2024-12-04T14:25:59Z DEBUG krbprincipalaux 2024-12-04T14:25:59Z DEBUG krbTicketPolicyAux 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ipaAllowedOperations 2024-12-04T14:25:59Z DEBUG krbPrincipalName: 2024-12-04T14:25:59Z DEBUG WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN 2024-12-04T14:25:59Z DEBUG krbCanonicalName: 2024-12-04T14:25:59Z DEBUG WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN 2024-12-04T14:25:59Z DEBUG krbLastPwdChange: 2024-12-04T14:25:59Z DEBUG 20241128130522Z 2024-12-04T14:25:59Z DEBUG krbPrincipalKey: 2024-12-04T14:25:59Z DEBUG XXXXXXXX 2024-12-04T14:25:59Z DEBUG krbExtraData: 2024-12-04T14:25:59Z DEBUG AAKSakhncm9vdC9hZG1pbkBGUkVFSVBBLlRFU1RET01BSU4A 2024-12-04T14:25:59Z DEBUG ipaAllowedToPerform;read_keys: 2024-12-04T14:25:59Z DEBUG cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG addifexist: 'ipaAllowedOperations' to objectclass, current value ['krbprincipal', 'krbprincipalaux', 'krbTicketPolicyAux', 'top', 'ipaAllowedOperations'] 2024-12-04T14:25:59Z DEBUG addifexist: set objectclass to ['krbprincipal', 'krbprincipalaux', 'krbTicketPolicyAux', 'top', 'ipaAllowedOperations', 'ipaAllowedOperations'] 2024-12-04T14:25:59Z DEBUG addifexist: '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)' to aci, current value ['(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG addifexist: set aci to ['(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:25:59Z DEBUG addifexist: 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain' to ipaAllowedToPerform;read_keys, current value ['cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG addifexist: set ipaAllowedToPerform;read_keys to ['cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: krbPrincipalName=WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbprincipal 2024-12-04T14:25:59Z DEBUG krbprincipalaux 2024-12-04T14:25:59Z DEBUG krbTicketPolicyAux 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ipaAllowedOperations 2024-12-04T14:25:59Z DEBUG ipaAllowedOperations 2024-12-04T14:25:59Z DEBUG krbPrincipalName: 2024-12-04T14:25:59Z DEBUG WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN 2024-12-04T14:25:59Z DEBUG krbCanonicalName: 2024-12-04T14:25:59Z DEBUG WELLKNOWN/ANONYMOUS@FREEIPA.TESTDOMAIN 2024-12-04T14:25:59Z DEBUG krbLastPwdChange: 2024-12-04T14:25:59Z DEBUG 20241128130522Z 2024-12-04T14:25:59Z DEBUG krbPrincipalKey: 2024-12-04T14:25:59Z DEBUG XXXXXXXX 2024-12-04T14:25:59Z DEBUG krbExtraData: 2024-12-04T14:25:59Z DEBUG AAKSakhncm9vdC9hZG1pbkBGUkVFSVBBLlRFU1RET01BSU4A 2024-12-04T14:25:59Z DEBUG ipaAllowedToPerform;read_keys: 2024-12-04T14:25:59Z DEBUG cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow to retrieve keytab keys of the anonymous user"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Posix IDs 2024-12-04T14:25:59Z DEBUG dnaExcludeScope: 2024-12-04T14:25:59Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaFilter: 2024-12-04T14:25:59Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:25:59Z DEBUG dnaMagicRegen: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG dnaMaxValue: 2024-12-04T14:25:59Z DEBUG 500000 2024-12-04T14:25:59Z DEBUG dnaNextValue: 2024-12-04T14:25:59Z DEBUG 60006 2024-12-04T14:25:59Z DEBUG dnaScope: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaSharedCfgDN: 2024-12-04T14:25:59Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaThreshold: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG dnaType: 2024-12-04T14:25:59Z DEBUG uidNumber 2024-12-04T14:25:59Z DEBUG gidNumber 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:59Z DEBUG add: '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Posix IDs 2024-12-04T14:25:59Z DEBUG dnaExcludeScope: 2024-12-04T14:25:59Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaFilter: 2024-12-04T14:25:59Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:25:59Z DEBUG dnaMagicRegen: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG dnaMaxValue: 2024-12-04T14:25:59Z DEBUG 500000 2024-12-04T14:25:59Z DEBUG dnaNextValue: 2024-12-04T14:25:59Z DEBUG 60006 2024-12-04T14:25:59Z DEBUG dnaScope: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaSharedCfgDN: 2024-12-04T14:25:59Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG dnaThreshold: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG dnaType: 2024-12-04T14:25:59Z DEBUG uidNumber 2024-12-04T14:25:59Z DEBUG gidNumber 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG userRoot 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsBackendInstance 2024-12-04T14:25:59Z DEBUG nsslapd-suffix: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-cachesize: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG nsslapd-cachememsize: 2024-12-04T14:25:59Z DEBUG 201326592 2024-12-04T14:25:59Z DEBUG nsslapd-readonly: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-index: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-internalop-index: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-dncachememsize: 2024-12-04T14:25:59Z DEBUG 67108864 2024-12-04T14:25:59Z DEBUG nsslapd-directory: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db/userRoot 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG remove: '(targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG remove: '(targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:25:59Z DEBUG add: '(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG userRoot 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsBackendInstance 2024-12-04T14:25:59Z DEBUG nsslapd-suffix: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-cachesize: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG nsslapd-cachememsize: 2024-12-04T14:25:59Z DEBUG 201326592 2024-12-04T14:25:59Z DEBUG nsslapd-readonly: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-index: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-internalop-index: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-dncachememsize: 2024-12-04T14:25:59Z DEBUG 67108864 2024-12-04T14:25:59Z DEBUG nsslapd-directory: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db/userRoot 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-aci.update 0.212 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-autobind.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG config 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsslapdConfig 2024-12-04T14:25:59Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:59Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-betype: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:59Z DEBUG cn=schema 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-plugin: 2024-12-04T14:25:59Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:59Z DEBUG 16384 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-port: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-localuser: 2024-12-04T14:25:59Z DEBUG dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordInHistory: 2024-12-04T14:25:59Z DEBUG 6 2024-12-04T14:25:59Z DEBUG passwordUnlock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordGraceLimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordMustChange: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:59Z DEBUG 100000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordWarning: 2024-12-04T14:25:59Z DEBUG 86400 2024-12-04T14:25:59Z DEBUG nsslapd-readonly: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:59Z DEBUG 16 2024-12-04T14:25:59Z DEBUG passwordLockout: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-localhost: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:59Z DEBUG 10000 2024-12-04T14:25:59Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:59Z DEBUG 40 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordMinLength: 2024-12-04T14:25:59Z DEBUG 8 2024-12-04T14:25:59Z DEBUG passwordMinDigits: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinAlphas: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinUppers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinLowers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinSpecials: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMin8bit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinCategories: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordPalindrome: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictCheck: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictPath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordUserAttributes: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordBadWords: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordMaxSequence: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:59Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:59Z DEBUG replication-only 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG passwordMaxFailure: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:59Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-security: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordMaxAge: 2024-12-04T14:25:59Z DEBUG 8640000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:59Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:59Z DEBUG passwordChange: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securePort: 2024-12-04T14:25:59Z DEBUG 636 2024-12-04T14:25:59Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:59Z DEBUG 223 2024-12-04T14:25:59Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordExp: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG day 2024-12-04T14:25:59Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-nagle: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:59Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:59Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:59Z DEBUG uidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:59Z DEBUG gidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:59Z DEBUG dc=example,dc=com 2024-12-04T14:25:59Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:59Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:59Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-counters: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG passwordMinAge: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:59Z DEBUG 209715200 2024-12-04T14:25:59Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:59Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:59Z DEBUG 524288 2024-12-04T14:25:59Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:59Z DEBUG allowed 2024-12-04T14:25:59Z DEBUG nsslapd-config: 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:59Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:59Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:59Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:59Z DEBUG /tmp 2024-12-04T14:25:59Z DEBUG nsslapd-certdir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:59Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:59Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rundir: 2024-12-04T14:25:59Z DEBUG /run/dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:59Z DEBUG 300000 2024-12-04T14:25:59Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-localssf: 2024-12-04T14:25:59Z DEBUG 71 2024-12-04T14:25:59Z DEBUG nsslapd-minssf: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:59Z DEBUG next 2024-12-04T14:25:59Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:59Z DEBUG warn 2024-12-04T14:25:59Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:59Z DEBUG 60 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:59Z DEBUG 20971520 2024-12-04T14:25:59Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:59Z DEBUG nolog 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:59Z DEBUG 128 2024-12-04T14:25:59Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:59Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:59Z DEBUG dirsrv-log 2024-12-04T14:25:59Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:59Z DEBUG process-safe 2024-12-04T14:25:59Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:59Z DEBUG 30 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordStorageScheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG passwordAdminDN: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:59Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:59Z DEBUG only: set nsslapd-ldapimaptoentries to 'on', current value ['on'] 2024-12-04T14:25:59Z DEBUG only: updated value ['on'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG config 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsslapdConfig 2024-12-04T14:25:59Z DEBUG nsslapd-backendconfig: 2024-12-04T14:25:59Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-betype: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:25:59Z DEBUG cn=schema 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-plugin: 2024-12-04T14:25:59Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-port 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:25:59Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:25:59Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:25:59Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:25:59Z DEBUG 16384 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-port: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-workingdir: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-localuser: 2024-12-04T14:25:59Z DEBUG dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordInHistory: 2024-12-04T14:25:59Z DEBUG 6 2024-12-04T14:25:59Z DEBUG passwordUnlock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordGraceLimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG passwordMustChange: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-sizelimit: 2024-12-04T14:25:59Z DEBUG 100000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordWarning: 2024-12-04T14:25:59Z DEBUG 86400 2024-12-04T14:25:59Z DEBUG nsslapd-readonly: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-threadnumber: 2024-12-04T14:25:59Z DEBUG 16 2024-12-04T14:25:59Z DEBUG passwordLockout: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-localhost: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:25:59Z DEBUG 10000 2024-12-04T14:25:59Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:25:59Z DEBUG 40 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG passwordMinLength: 2024-12-04T14:25:59Z DEBUG 8 2024-12-04T14:25:59Z DEBUG passwordMinDigits: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinAlphas: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinUppers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinLowers: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinSpecials: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMin8bit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxRepeats: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMinCategories: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordMinTokenLength: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG passwordPalindrome: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictCheck: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordDictPath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordUserAttributes: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordBadWords: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordMaxSequence: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxSeqSets: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordMaxClassChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:25:59Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-schemacheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-schemamod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-schemareplace: 2024-12-04T14:25:59Z DEBUG replication-only 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG passwordMaxFailure: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:25:59Z DEBUG nsslapd-lastmod: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-security: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordMaxAge: 2024-12-04T14:25:59Z DEBUG 8640000 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG passwordResetFailureCount: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG passwordTPRMaxUse: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordLegacyPolicy: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-rootpw: 2024-12-04T14:25:59Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:25:59Z DEBUG passwordChange: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-statlog-level: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:25:59Z DEBUG 256 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securePort: 2024-12-04T14:25:59Z DEBUG 636 2024-12-04T14:25:59Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-timelimit: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:25:59Z DEBUG 223 2024-12-04T14:25:59Z DEBUG nsslapd-svrtab: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG passwordExp: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG passwordSendExpiringTime: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG day 2024-12-04T14:25:59Z DEBUG passwordLockoutDuration: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-idletimeout: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-nagle: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-csnlogging: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordCheckSyntax: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-snmp-index: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:25:59Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:25:59Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:25:59Z DEBUG uidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:25:59Z DEBUG gidNumber 2024-12-04T14:25:59Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:25:59Z DEBUG dc=example,dc=com 2024-12-04T14:25:59Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:25:59Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:25:59Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-counters: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-rootdn: 2024-12-04T14:25:59Z DEBUG cn=Directory Manager 2024-12-04T14:25:59Z DEBUG passwordMinAge: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-result-tweak: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-maxbersize: 2024-12-04T14:25:59Z DEBUG 209715200 2024-12-04T14:25:59Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-versionstring: 2024-12-04T14:25:59Z DEBUG 389-Directory/2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-referralmode: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-numlisteners: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:25:59Z DEBUG 524288 2024-12-04T14:25:59Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:25:59Z DEBUG allowed 2024-12-04T14:25:59Z DEBUG nsslapd-config: 2024-12-04T14:25:59Z DEBUG cn=config 2024-12-04T14:25:59Z DEBUG nsslapd-instancedir: 2024-12-04T14:25:59Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-schemadir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:25:59Z DEBUG nsslapd-lockdir: 2024-12-04T14:25:59Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-tmpdir: 2024-12-04T14:25:59Z DEBUG /tmp 2024-12-04T14:25:59Z DEBUG nsslapd-certdir: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:25:59Z DEBUG nsslapd-ldifdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:25:59Z DEBUG nsslapd-bakdir: 2024-12-04T14:25:59Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:25:59Z DEBUG nsslapd-saslpath: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rundir: 2024-12-04T14:25:59Z DEBUG /run/dirsrv 2024-12-04T14:25:59Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:25:59Z DEBUG 300000 2024-12-04T14:25:59Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-localssf: 2024-12-04T14:25:59Z DEBUG 71 2024-12-04T14:25:59Z DEBUG nsslapd-minssf: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:25:59Z DEBUG next 2024-12-04T14:25:59Z DEBUG nsslapd-validate-cert: 2024-12-04T14:25:59Z DEBUG warn 2024-12-04T14:25:59Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:25:59Z DEBUG 60 2024-12-04T14:25:59Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:25:59Z DEBUG 20971520 2024-12-04T14:25:59Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:25:59Z DEBUG nolog 2024-12-04T14:25:59Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:25:59Z DEBUG 2097152 2024-12-04T14:25:59Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:25:59Z DEBUG 128 2024-12-04T14:25:59Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:25:59Z DEBUG -10 2024-12-04T14:25:59Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 2 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:25:59Z DEBUG 600 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:25:59Z DEBUG 500 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:25:59Z DEBUG 100 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:25:59Z DEBUG 10 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:25:59Z DEBUG month 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:25:59Z DEBUG week 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:25:59Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-logging-backend: 2024-12-04T14:25:59Z DEBUG dirsrv-log 2024-12-04T14:25:59Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:25:59Z DEBUG process-safe 2024-12-04T14:25:59Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:25:59Z DEBUG 3600 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:25:59Z DEBUG 30 2024-12-04T14:25:59Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:25:59Z DEBUG 300 2024-12-04T14:25:59Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG passwordStorageScheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG passwordAdminDN: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:25:59Z DEBUG PBKDF2-SHA512 2024-12-04T14:25:59Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:25:59Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:25:59Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-hash-filters: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:25:59Z DEBUG 2024-12-04T14:25:59Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:25:59Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Deleting entry cn=root-autobind,cn=config 2024-12-04T14:25:59Z DEBUG cn=root-autobind,cn=config did not exist:no such entry 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-autobind.update 0.063 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-default_password_policy.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Host Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Host Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Host Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Host Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Host Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Service Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Service Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Service Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Service Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Service Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Kerberos Service Password Policy 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Kerberos Service Password Policy 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ipapwdpolicy 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Kerberos Service Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordGraceLimit: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ipapwdpolicy 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Kerberos Service Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG passwordGraceLimit: 2024-12-04T14:25:59Z DEBUG -1 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default System Accounts Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default System Accounts Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default System Accounts Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 8 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default System Accounts Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG krbPwdPolicy 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default System Accounts Password Policy 2024-12-04T14:25:59Z DEBUG krbMinPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinDiffChars: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMinLength: 2024-12-04T14:25:59Z DEBUG 8 2024-12-04T14:25:59Z DEBUG krbPwdHistoryLength: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbMaxPwdLife: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdMaxFailure: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdFailureCountInterval: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG krbPwdLockoutDuration: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Host Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Host Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Hosts 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Hosts 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Service Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Service Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Services 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Services 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Kerberos Services 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for Kerberos Services 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG cosTemplates 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default System Accounts Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cosTemplate 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG krbContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG cosPriority: 2024-12-04T14:25:59Z DEBUG 10000000000 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference: 2024-12-04T14:25:59Z DEBUG cn=Default System Accounts Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Default Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for System Accounts 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Default Password Policy,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG Default Password Policy for System Accounts 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG ldapsubentry 2024-12-04T14:25:59Z DEBUG cosSuperDefinition 2024-12-04T14:25:59Z DEBUG cosPointerDefinition 2024-12-04T14:25:59Z DEBUG costemplatedn: 2024-12-04T14:25:59Z DEBUG cn=Default Password Policy,cn=cosTemplates,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cosAttribute: 2024-12-04T14:25:59Z DEBUG krbPwdPolicyReference default 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Default Password Policy 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-default_password_policy.update 0.044 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-dna.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa-winsync 2024-12-04T14:25:59Z DEBUG ipawinsyncacctdisable: 2024-12-04T14:25:59Z DEBUG both 2024-12-04T14:25:59Z DEBUG ipawinsyncdefaultgroupattr: 2024-12-04T14:25:59Z DEBUG ipaDefaultPrimaryGroup 2024-12-04T14:25:59Z DEBUG ipawinsyncdefaultgroupfilter: 2024-12-04T14:25:59Z DEBUG (gidNumber=*)(objectclass=posixGroup)(objectclass=groupOfNames) 2024-12-04T14:25:59Z DEBUG ipawinsyncforcesync: 2024-12-04T14:25:59Z DEBUG true 2024-12-04T14:25:59Z DEBUG ipawinsynchomedirattr: 2024-12-04T14:25:59Z DEBUG ipaHomesRootDir 2024-12-04T14:25:59Z DEBUG ipawinsyncloginshellattr: 2024-12-04T14:25:59Z DEBUG ipaDefaultLoginShell 2024-12-04T14:25:59Z DEBUG ipawinsyncnewentryfilter: 2024-12-04T14:25:59Z DEBUG (cn=ipaConfig) 2024-12-04T14:25:59Z DEBUG ipawinsyncnewuserocattr: 2024-12-04T14:25:59Z DEBUG ipauserobjectclasses 2024-12-04T14:25:59Z DEBUG ipawinsyncrealmattr: 2024-12-04T14:25:59Z DEBUG cn 2024-12-04T14:25:59Z DEBUG ipawinsyncrealmfilter: 2024-12-04T14:25:59Z DEBUG (objectclass=krbRealmContainer) 2024-12-04T14:25:59Z DEBUG ipawinsyncuserattr: 2024-12-04T14:25:59Z DEBUG uidNumber -1 2024-12-04T14:25:59Z DEBUG gidNumber -1 2024-12-04T14:25:59Z DEBUG ipawinsyncuserflatten: 2024-12-04T14:25:59Z DEBUG true 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG ipa winsync plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG ipa-winsync-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG ipa_winsync_plugin_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libipa_winsync 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG FreeIPA project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG FreeIPA/1.0 2024-12-04T14:25:59Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:59Z DEBUG 60 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG remove: 'uidNumber 999' from ipaWinSyncUserAttr, current value ['uidNumber -1', 'gidNumber -1'] 2024-12-04T14:25:59Z DEBUG remove: 'uidNumber 999' not in ipaWinSyncUserAttr 2024-12-04T14:25:59Z DEBUG remove: 'gidNumber 999' from ipaWinSyncUserAttr, current value ['uidNumber -1', 'gidNumber -1'] 2024-12-04T14:25:59Z DEBUG remove: 'gidNumber 999' not in ipaWinSyncUserAttr 2024-12-04T14:25:59Z DEBUG add: 'uidNumber -1' to ipaWinSyncUserAttr, current value ['uidNumber -1', 'gidNumber -1'] 2024-12-04T14:25:59Z DEBUG add: updated value ['gidNumber -1', 'uidNumber -1'] 2024-12-04T14:25:59Z DEBUG add: 'gidNumber -1' to ipaWinSyncUserAttr, current value ['gidNumber -1', 'uidNumber -1'] 2024-12-04T14:25:59Z DEBUG add: updated value ['uidNumber -1', 'gidNumber -1'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipa-winsync,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipa-winsync 2024-12-04T14:25:59Z DEBUG ipawinsyncacctdisable: 2024-12-04T14:25:59Z DEBUG both 2024-12-04T14:25:59Z DEBUG ipawinsyncdefaultgroupattr: 2024-12-04T14:25:59Z DEBUG ipaDefaultPrimaryGroup 2024-12-04T14:25:59Z DEBUG ipawinsyncdefaultgroupfilter: 2024-12-04T14:25:59Z DEBUG (gidNumber=*)(objectclass=posixGroup)(objectclass=groupOfNames) 2024-12-04T14:25:59Z DEBUG ipawinsyncforcesync: 2024-12-04T14:25:59Z DEBUG true 2024-12-04T14:25:59Z DEBUG ipawinsynchomedirattr: 2024-12-04T14:25:59Z DEBUG ipaHomesRootDir 2024-12-04T14:25:59Z DEBUG ipawinsyncloginshellattr: 2024-12-04T14:25:59Z DEBUG ipaDefaultLoginShell 2024-12-04T14:25:59Z DEBUG ipawinsyncnewentryfilter: 2024-12-04T14:25:59Z DEBUG (cn=ipaConfig) 2024-12-04T14:25:59Z DEBUG ipawinsyncnewuserocattr: 2024-12-04T14:25:59Z DEBUG ipauserobjectclasses 2024-12-04T14:25:59Z DEBUG ipawinsyncrealmattr: 2024-12-04T14:25:59Z DEBUG cn 2024-12-04T14:25:59Z DEBUG ipawinsyncrealmfilter: 2024-12-04T14:25:59Z DEBUG (objectclass=krbRealmContainer) 2024-12-04T14:25:59Z DEBUG ipawinsyncuserattr: 2024-12-04T14:25:59Z DEBUG uidNumber -1 2024-12-04T14:25:59Z DEBUG gidNumber -1 2024-12-04T14:25:59Z DEBUG ipawinsyncuserflatten: 2024-12-04T14:25:59Z DEBUG true 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG ipa winsync plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG ipa-winsync-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG ipa_winsync_plugin_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libipa_winsync 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG FreeIPA project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG FreeIPA/1.0 2024-12-04T14:25:59Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:59Z DEBUG 60 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-dna.update 0.006 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-enable_dirsrv_plugins.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG 7-bit check 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG NS7bitAttr 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG NS7bitAttr_Init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libattr-unique-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:59Z DEBUG uid 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:25:59Z DEBUG mail 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:25:59Z DEBUG , 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG 7-bit check 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG NS7bitAttr 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG NS7bitAttr_Init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libattr-unique-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:59Z DEBUG uid 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:25:59Z DEBUG mail 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:25:59Z DEBUG , 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Account Usability Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Account Usability Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Account Usability Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Account Usability Control plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Account Usability Control 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG auc_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacctusability-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Account Usability Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Account Usability Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Account Usability Control plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Account Usability Control 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG auc_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacctusability-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ACL Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ACL Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ACL Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG acl access check plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG acl 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG acl_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacl-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG accesscontrol 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ACL Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ACL Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG acl access check plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG acl 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG acl_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacl-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG accesscontrol 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ACL preoperation,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ACL preoperation,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ACL preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG acl access check plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG acl 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG acl_preopInit 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacl-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ACL preoperation,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ACL preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG acl access check plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG acl 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG acl_preopInit 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libacl-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG automemberprocessmodifyops: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Auto Membership Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:59Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Auto Membership plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Auto Membership 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG automember_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libautomember-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG automemberprocessmodifyops: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Auto Membership Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:59Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Auto Membership plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Auto Membership 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG automember_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libautomember-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Bitwise Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Bitwise Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Bitwise Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG bitwise match plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG bitwise 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG bitwise_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libbitwise-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG matchingRule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Bitwise Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Bitwise Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG bitwise match plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG bitwise 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG bitwise_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libbitwise-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG matchingRule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=chaining database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=chaining database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG chaining database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG LDAP chaining backend database plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG chaining database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG chaining_back_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libchainingdb-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=chaining database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG chaining database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG LDAP chaining backend database plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG chaining database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG chaining_back_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libchainingdb-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Class of Service,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Class of Service,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Class of Service 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG class of service plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG cos 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG cos_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libcos-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Class of Service,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Class of Service 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG class of service plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG cos 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG cos_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libcos-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=deref,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=deref,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG deref 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Dereference plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Dereference 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG deref_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libderef-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=deref,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG deref 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Dereference plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Dereference 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG deref_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libderef-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG preoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG New entry: cn=HTTP Client,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=HTTP Client,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=HTTP Client,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Internationalization Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Internationalization Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Internationalization Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG internationalized ordering rule plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG orderingrule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG orderingRule_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libcollation-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG matchingRule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/slapd-collations.conf 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Internationalization Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Internationalization Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG internationalized ordering rule plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG orderingrule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG orderingRule_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libcollation-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG matchingRule 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:25:59Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/slapd-collations.conf 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Linked Attributes 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Linked Attributes plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Linked Attributes 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG linked_attrs_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG liblinkedattrs-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Linked Attributes,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Linked Attributes 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Linked Attributes plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Linked Attributes 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG linked_attrs_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG liblinkedattrs-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Managed Entries 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:59Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Managed Entries plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Managed Entries 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG mep_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Managed Entries,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Managed Entries 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:25:59Z DEBUG cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Managed Entries plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG Managed Entries 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG mep_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libmanagedentries-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpreoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG AES 2024-12-04T14:25:59Z DEBUG Class of Service 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Multi-supplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG replication-multisupplier 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG replication_multisupplier_plugin_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libreplication-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Multisupplier Replication Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG AES 2024-12-04T14:25:59Z DEBUG Class of Service 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Multi-supplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG replication-multisupplier 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG replication_multisupplier_plugin_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libreplication-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Roles Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG roles plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG roles 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG roles_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libroles-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Roles Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Roles Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG roles plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG roles 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG roles_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libroles-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Schema Reload,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Schema Reload,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Schema Reload 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG task plugin to reload schema files 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG schemareload 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG schemareload_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libschemareload-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Schema Reload,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Schema Reload 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG task plugin to reload schema files 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG schemareload 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG schemareload_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libschemareload-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG state change notification service plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG statechange 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG statechange_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libstatechange-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpostoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=State Change Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG state change notification service plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG statechange 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG statechange_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libstatechange-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG betxnpostoperation 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Views,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Views,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG virtual directory information tree views plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG views 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG views_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libviews-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Views,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Views 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG State Change Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG virtual directory information tree views plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG views 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG views_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libviews-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=whoami,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=whoami,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG whoami 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG whoami extended operation plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG whoami-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG whoami_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libwhoami-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG extendedop 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG replace: off not found, skipping 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=whoami,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG whoami 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG whoami extended operation plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG whoami-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG whoami_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libwhoami-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG extendedop 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-enable_dirsrv_plugins.update 0.065 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-host_nis_groups.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=NGP HGP Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=NGP HGP Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG mepTemplateEntry 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG NGP HGP Template 2024-12-04T14:25:59Z DEBUG mepRDNAttr: 2024-12-04T14:25:59Z DEBUG cn 2024-12-04T14:25:59Z DEBUG mepStaticAttr: 2024-12-04T14:25:59Z DEBUG ipaUniqueId: autogenerate 2024-12-04T14:25:59Z DEBUG objectclass: ipanisnetgroup 2024-12-04T14:25:59Z DEBUG objectclass: ipaobject 2024-12-04T14:25:59Z DEBUG nisDomainName: freeipa.testdomain 2024-12-04T14:25:59Z DEBUG mepMappedAttr: 2024-12-04T14:25:59Z DEBUG cn: $cn 2024-12-04T14:25:59Z DEBUG memberHost: $dn 2024-12-04T14:25:59Z DEBUG description: ipaNetgroup $cn 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=NGP HGP Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG mepTemplateEntry 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG NGP HGP Template 2024-12-04T14:25:59Z DEBUG mepRDNAttr: 2024-12-04T14:25:59Z DEBUG cn 2024-12-04T14:25:59Z DEBUG mepStaticAttr: 2024-12-04T14:25:59Z DEBUG ipaUniqueId: autogenerate 2024-12-04T14:25:59Z DEBUG objectclass: ipanisnetgroup 2024-12-04T14:25:59Z DEBUG objectclass: ipaobject 2024-12-04T14:25:59Z DEBUG nisDomainName: freeipa.testdomain 2024-12-04T14:25:59Z DEBUG mepMappedAttr: 2024-12-04T14:25:59Z DEBUG cn: $cn 2024-12-04T14:25:59Z DEBUG memberHost: $dn 2024-12-04T14:25:59Z DEBUG description: ipaNetgroup $cn 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=NGP Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=NGP Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG NGP Definition 2024-12-04T14:25:59Z DEBUG originScope: 2024-12-04T14:25:59Z DEBUG cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG originFilter: 2024-12-04T14:25:59Z DEBUG objectclass=ipahostgroup 2024-12-04T14:25:59Z DEBUG managedBase: 2024-12-04T14:25:59Z DEBUG cn=ng,cn=alt,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG managedTemplate: 2024-12-04T14:25:59Z DEBUG cn=NGP HGP Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG only: set cn to 'NGP Definition', current value ['NGP Definition'] 2024-12-04T14:25:59Z DEBUG only: updated value ['NGP Definition'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=NGP Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG NGP Definition 2024-12-04T14:25:59Z DEBUG originScope: 2024-12-04T14:25:59Z DEBUG cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG originFilter: 2024-12-04T14:25:59Z DEBUG objectclass=ipahostgroup 2024-12-04T14:25:59Z DEBUG managedBase: 2024-12-04T14:25:59Z DEBUG cn=ng,cn=alt,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG managedTemplate: 2024-12-04T14:25:59Z DEBUG cn=NGP HGP Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-host_nis_groups.update 0.005 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-indices.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=accessRuleType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=accessRuleType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG accessRuleType 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'accessRuleType', current value ['accessRuleType'] 2024-12-04T14:25:59Z DEBUG only: updated value ['accessRuleType'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=accessRuleType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG accessRuleType 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=altSecurityIdentities,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=altSecurityIdentities,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG altSecurityIdentities 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'altSecurityIdentities', current value ['altSecurityIdentities'] 2024-12-04T14:25:59Z DEBUG only: updated value ['altSecurityIdentities'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=altSecurityIdentities,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG altSecurityIdentities 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=automountkey,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=automountkey,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG automountkey 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'automountkey', current value ['automountkey'] 2024-12-04T14:25:59Z DEBUG only: updated value ['automountkey'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=automountkey,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG automountkey 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=automountMapName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=automountMapName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG automountMapName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'automountMapName', current value ['automountMapName'] 2024-12-04T14:25:59Z DEBUG only: updated value ['automountMapName'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=automountMapName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG automountMapName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=carLicense,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=carLicense,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG carLicense 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'carLicense', current value ['carLicense'] 2024-12-04T14:25:59Z DEBUG only: updated value ['carLicense'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=carLicense,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG carLicense 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=description,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=description,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG description 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'description', current value ['description'] 2024-12-04T14:25:59Z DEBUG only: updated value ['description'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=description,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG description 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG displayname 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'displayname', current value ['displayname'] 2024-12-04T14:25:59Z DEBUG only: updated value ['displayname'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG displayname 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=fqdn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=fqdn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG fqdn 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'fqdn', current value ['fqdn'] 2024-12-04T14:25:59Z DEBUG only: updated value ['fqdn'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=fqdn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG fqdn 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=gidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=gidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG gidnumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'gidnumber', current value ['gidnumber'] 2024-12-04T14:25:59Z DEBUG only: updated value ['gidnumber'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG add: 'integerOrderingMatch' to nsMatchingRule, current value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG add: updated value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=gidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG gidnumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=hostCategory,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=hostCategory,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hostCategory 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'hostCategory', current value ['hostCategory'] 2024-12-04T14:25:59Z DEBUG only: updated value ['hostCategory'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=hostCategory,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG hostCategory 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=idnsName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=idnsName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG idnsName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'idnsName', current value ['idnsName'] 2024-12-04T14:25:59Z DEBUG only: updated value ['idnsName'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=idnsName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG idnsName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaallowedtarget 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaallowedtarget', current value ['ipaallowedtarget'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaallowedtarget'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaallowedtarget 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaAnchorUUID 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaAnchorUUID', current value ['ipaAnchorUUID'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaAnchorUUID'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaAnchorUUID 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaassignedidview,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaassignedidview,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaassignedidview 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaassignedidview', current value ['ipaassignedidview'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaassignedidview'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaassignedidview,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaassignedidview 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaCASubjectDN,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaCASubjectDN,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaCASubjectDN 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaCASubjectDN', current value ['ipaCASubjectDN'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaCASubjectDN'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaCASubjectDN,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaCASubjectDN 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaCertmapData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaCertmapData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaCertmapData 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaCertmapData', current value ['ipaCertmapData'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaCertmapData'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaCertmapData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaCertmapData 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaConfigString,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaConfigString,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaConfigString 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaConfigString', current value ['ipaConfigString'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaConfigString'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaConfigString,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaConfigString 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaEnabledFlag,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaEnabledFlag,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaEnabledFlag 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaEnabledFlag', current value ['ipaEnabledFlag'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaEnabledFlag'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaEnabledFlag,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaEnabledFlag 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaExternalMember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaExternalMember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaExternalMember 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaExternalMember', current value ['ipaExternalMember'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaExternalMember'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaExternalMember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaExternalMember 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaIdpDevAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpDevAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpDevAuthEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaIdpDevAuthEndpoint', current value ['ipaIdpDevAuthEndpoint'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaIdpDevAuthEndpoint'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpDevAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpDevAuthEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaIdpAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpAuthEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaIdpAuthEndpoint', current value ['ipaIdpAuthEndpoint'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaIdpAuthEndpoint'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpAuthEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaIdpScope,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpScope,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpScope 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaIdpScope', current value ['ipaIdpScope'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaIdpScope'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpScope,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpScope 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaIdpTokenEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpTokenEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpTokenEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaIdpTokenEndpoint', current value ['ipaIdpTokenEndpoint'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaIdpTokenEndpoint'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaIdpTokenEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaIdpTokenEndpoint 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaKrbAuthzData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaKrbAuthzData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaKrbAuthzData 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaKrbAuthzData', current value ['ipaKrbAuthzData'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaKrbAuthzData'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaKrbAuthzData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaKrbAuthzData 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipakrbprincipalalias,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipakrbprincipalalias,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipakrbprincipalalias 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipakrbprincipalalias', current value ['ipakrbprincipalalias'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipakrbprincipalalias'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipakrbprincipalalias,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipakrbprincipalalias 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipalocation,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipalocation,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipalocation 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipalocation', current value ['ipalocation'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipalocation'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipalocation,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipalocation 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaMemberCa,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaMemberCa,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaMemberCa 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaMemberCa', current value ['ipaMemberCa'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaMemberCa'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaMemberCa,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaMemberCa 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaMemberCertProfile,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaMemberCertProfile,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaMemberCertProfile 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaMemberCertProfile', current value ['ipaMemberCertProfile'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaMemberCertProfile'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaMemberCertProfile,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaMemberCertProfile 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaNTSecurityIdentifier,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaNTSecurityIdentifier,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaNTSecurityIdentifier 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaNTSecurityIdentifier', current value ['ipaNTSecurityIdentifier'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaNTSecurityIdentifier'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaNTSecurityIdentifier,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaNTSecurityIdentifier 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaNTTrustPartner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaNTTrustPartner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaNTTrustPartner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaNTTrustPartner', current value ['ipaNTTrustPartner'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaNTTrustPartner'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaNTTrustPartner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaNTTrustPartner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaOriginalUid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaOriginalUid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaOriginalUid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaOriginalUid', current value ['ipaOriginalUid'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaOriginalUid'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaOriginalUid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaOriginalUid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaOwner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaOwner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaOwner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaOwner', current value ['ipaOwner'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaOwner'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaOwner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaOwner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipasudorunas,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipasudorunas,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipasudorunas 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipasudorunas', current value ['ipasudorunas'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipasudorunas'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipasudorunas,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipasudorunas 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaSubGidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaSubGidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaSubGidNumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaSubGidNumber', current value ['ipaSubGidNumber'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaSubGidNumber'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'integerOrderingMatch' to nsMatchingRule, current value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG add: updated value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaSubGidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaSubGidNumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaSubUidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaSubUidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaSubUidNumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipaSubUidNumber', current value ['ipaSubUidNumber'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipaSubUidNumber'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'integerOrderingMatch' to nsMatchingRule, current value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG add: updated value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaSubUidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaSubUidNumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=sudoorder,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=sudoorder,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sudoorder 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'sudoorder', current value ['sudoorder'] 2024-12-04T14:25:59Z DEBUG only: updated value ['sudoorder'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'integerOrderingMatch' to nsMatchingRule, current value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG add: updated value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=sudoorder,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sudoorder 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipasudorunasgroup,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipasudorunasgroup,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipasudorunasgroup 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipasudorunasgroup', current value ['ipasudorunasgroup'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipasudorunasgroup'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipasudorunasgroup,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipasudorunasgroup 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipatokenradiusconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipatokenradiusconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipatokenradiusconfiglink', current value ['ipatokenradiusconfiglink'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipatokenradiusconfiglink'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipatokenradiusconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipauniqueid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipauniqueid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipauniqueid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipauniqueid', current value ['ipauniqueid'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipauniqueid'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipauniqueid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipauniqueid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipServicePort,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipServicePort,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipServicePort 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ipServicePort', current value ['ipServicePort'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ipServicePort'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipServicePort,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipServicePort 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=krbCanonicalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=krbCanonicalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbCanonicalName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'krbCanonicalName', current value ['krbCanonicalName'] 2024-12-04T14:25:59Z DEBUG only: updated value ['krbCanonicalName'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=krbCanonicalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbCanonicalName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=krbPasswordExpiration,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=krbPasswordExpiration,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbPasswordExpiration 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'krbPasswordExpiration', current value ['krbPasswordExpiration'] 2024-12-04T14:25:59Z DEBUG only: updated value ['krbPasswordExpiration'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=krbPasswordExpiration,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbPasswordExpiration 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=krbPrincipalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=krbPrincipalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbPrincipalName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG caseIgnoreIA5Match 2024-12-04T14:25:59Z DEBUG caseExactIA5Match 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'krbPrincipalName', current value ['krbPrincipalName'] 2024-12-04T14:25:59Z DEBUG only: updated value ['krbPrincipalName'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: 'caseIgnoreIA5Match' to nsMatchingRule, current value ['caseIgnoreIA5Match', 'caseExactIA5Match'] 2024-12-04T14:25:59Z DEBUG add: updated value ['caseExactIA5Match', 'caseIgnoreIA5Match'] 2024-12-04T14:25:59Z DEBUG add: 'caseExactIA5Match' to nsMatchingRule, current value ['caseExactIA5Match', 'caseIgnoreIA5Match'] 2024-12-04T14:25:59Z DEBUG add: updated value ['caseIgnoreIA5Match', 'caseExactIA5Match'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=krbPrincipalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG krbPrincipalName 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG caseIgnoreIA5Match 2024-12-04T14:25:59Z DEBUG caseExactIA5Match 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=l,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=l,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG l 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'l', current value ['l'] 2024-12-04T14:25:59Z DEBUG only: updated value ['l'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=l,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG l 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=macAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=macAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG macAddress 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'macAddress', current value ['macAddress'] 2024-12-04T14:25:59Z DEBUG only: updated value ['macAddress'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=macAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG macAddress 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=managedby,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=managedby,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG managedby 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'managedby', current value ['managedby'] 2024-12-04T14:25:59Z DEBUG only: updated value ['managedby'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=managedby,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG managedby 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=manager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=manager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG manager 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'manager', current value ['manager'] 2024-12-04T14:25:59Z DEBUG only: updated value ['manager'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=manager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG manager 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=member,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=member,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG member 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'member', current value ['member'] 2024-12-04T14:25:59Z DEBUG only: updated value ['member'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=member,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG member 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberallowcmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberallowcmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberallowcmd 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberallowcmd', current value ['memberallowcmd'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberallowcmd'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberallowcmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberallowcmd 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberdenycmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberdenycmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberdenycmd 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberdenycmd', current value ['memberdenycmd'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberdenycmd'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberdenycmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberdenycmd 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberHost 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberHost', current value ['memberHost'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberHost'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberHost 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberManager 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberManager', current value ['memberManager'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberManager'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberManager 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberOf,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberOf,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberOf 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberOf', current value ['memberOf'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberOf'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberOf,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberOf 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberPrincipal,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberPrincipal,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberPrincipal 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberPrincipal', current value ['memberPrincipal'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberPrincipal'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberPrincipal,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberPrincipal 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberservice,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberservice,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberservice 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberservice', current value ['memberservice'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberservice'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberservice,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberservice 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberuid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberuid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberuid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberuid', current value ['memberuid'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberuid'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberuid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberuid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberUser 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'memberUser', current value ['memberUser'] 2024-12-04T14:25:59Z DEBUG only: updated value ['memberUser'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG memberUser 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=nsHardwarePlatform,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=nsHardwarePlatform,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsHardwarePlatform 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'nsHardwarePlatform', current value ['nsHardwarePlatform'] 2024-12-04T14:25:59Z DEBUG only: updated value ['nsHardwarePlatform'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=nsHardwarePlatform,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsHardwarePlatform 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=nsHostLocation,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=nsHostLocation,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsHostLocation 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'nsHostLocation', current value ['nsHostLocation'] 2024-12-04T14:25:59Z DEBUG only: updated value ['nsHostLocation'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=nsHostLocation,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsHostLocation 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=nsOsVersion,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=nsOsVersion,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsOsVersion 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'nsOsVersion', current value ['nsOsVersion'] 2024-12-04T14:25:59Z DEBUG only: updated value ['nsOsVersion'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=nsOsVersion,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG nsOsVersion 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsindex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ntUniqueId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ntUniqueId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ntUniqueId 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'ntUniqueId', current value ['ntUniqueId'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ntUniqueId'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ntUniqueId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ntUniqueId 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ntUserDomainId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ntUserDomainId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ntUserDomainId 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'ntUserDomainId', current value ['ntUserDomainId'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ntUserDomainId'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ntUserDomainId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ntUserDomainId 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ou,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ou,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ou 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'ou', current value ['ou'] 2024-12-04T14:25:59Z DEBUG only: updated value ['ou'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ou,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ou 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=owner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=owner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG owner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'owner', current value ['owner'] 2024-12-04T14:25:59Z DEBUG only: updated value ['owner'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=owner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG owner 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG secretary 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'secretary', current value ['secretary'] 2024-12-04T14:25:59Z DEBUG only: updated value ['secretary'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG secretary 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=seeAlso,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=seeAlso,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG seealso 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'seealso', current value ['seealso'] 2024-12-04T14:25:59Z DEBUG only: updated value ['seealso'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=seeAlso,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG seealso 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=serverhostname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=serverhostname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG serverhostname 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'serverhostname', current value ['serverhostname'] 2024-12-04T14:25:59Z DEBUG only: updated value ['serverhostname'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=serverhostname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG serverhostname 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=sourcehost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=sourcehost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sourcehost 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'sourcehost', current value ['sourcehost'] 2024-12-04T14:25:59Z DEBUG only: updated value ['sourcehost'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=sourcehost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG sourcehost 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=title,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=title,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG title 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'title', current value ['title'] 2024-12-04T14:25:59Z DEBUG only: updated value ['title'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=title,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG title 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=uid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=uid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'uid', current value ['uid'] 2024-12-04T14:25:59Z DEBUG only: updated value ['uid'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=uid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uid 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=uidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=uidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uidnumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'uidnumber', current value ['uidnumber'] 2024-12-04T14:25:59Z DEBUG only: updated value ['uidnumber'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq'] 2024-12-04T14:25:59Z DEBUG add: 'integerOrderingMatch' to nsMatchingRule, current value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG add: updated value ['integerOrderingMatch'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=uidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uidnumber 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG nsMatchingRule: 2024-12-04T14:25:59Z DEBUG integerOrderingMatch 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=uniquemember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=uniquemember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uniquemember 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG only: set cn to 'uniquemember', current value ['uniquemember'] 2024-12-04T14:25:59Z DEBUG only: updated value ['uniquemember'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG add: updated value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'sub'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=uniquemember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG uniquemember 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG sub 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG userCertificate 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG only: set cn to 'userCertificate', current value ['userCertificate'] 2024-12-04T14:25:59Z DEBUG only: updated value ['userCertificate'] 2024-12-04T14:25:59Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG add: updated value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'eq'] 2024-12-04T14:25:59Z DEBUG add: updated value ['eq', 'pres'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG userCertificate 2024-12-04T14:25:59Z DEBUG nsIndexType: 2024-12-04T14:25:59Z DEBUG eq 2024-12-04T14:25:59Z DEBUG pres 2024-12-04T14:25:59Z DEBUG nsSystemIndex: 2024-12-04T14:25:59Z DEBUG false 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsIndex 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-indices.update 0.677 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-ipaservers_hostgroup.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupOfNames 2024-12-04T14:25:59Z DEBUG nestedGroup 2024-12-04T14:25:59Z DEBUG ipaobject 2024-12-04T14:25:59Z DEBUG ipahostgroup 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG IPA server hosts 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaservers 2024-12-04T14:25:59Z DEBUG ipaUniqueID: 2024-12-04T14:25:59Z DEBUG 653b6fe0-ad89-11ef-8054-d21a665e43da 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG memberOf: 2024-12-04T14:25:59Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupOfNames 2024-12-04T14:25:59Z DEBUG nestedGroup 2024-12-04T14:25:59Z DEBUG ipaobject 2024-12-04T14:25:59Z DEBUG ipahostgroup 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG IPA server hosts 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaservers 2024-12-04T14:25:59Z DEBUG ipaUniqueID: 2024-12-04T14:25:59Z DEBUG 653b6fe0-ad89-11ef-8054-d21a665e43da 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG memberOf: 2024-12-04T14:25:59Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupOfNames 2024-12-04T14:25:59Z DEBUG nestedGroup 2024-12-04T14:25:59Z DEBUG ipaobject 2024-12-04T14:25:59Z DEBUG ipahostgroup 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG IPA server hosts 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaservers 2024-12-04T14:25:59Z DEBUG ipaUniqueID: 2024-12-04T14:25:59Z DEBUG 653b6fe0-ad89-11ef-8054-d21a665e43da 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG memberOf: 2024-12-04T14:25:59Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG add: 'fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupOfNames 2024-12-04T14:25:59Z DEBUG nestedGroup 2024-12-04T14:25:59Z DEBUG ipaobject 2024-12-04T14:25:59Z DEBUG ipahostgroup 2024-12-04T14:25:59Z DEBUG description: 2024-12-04T14:25:59Z DEBUG IPA server hosts 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG ipaservers 2024-12-04T14:25:59Z DEBUG ipaUniqueID: 2024-12-04T14:25:59Z DEBUG 653b6fe0-ad89-11ef-8054-d21a665e43da 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG memberOf: 2024-12-04T14:25:59Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-ipaservers_hostgroup.update 0.008 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-nss_ldap.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG add: 'domain' to objectClass, current value ['top', 'domain', 'pilotObject', 'domainRelatedObject', 'nisDomainObject'] 2024-12-04T14:25:59Z DEBUG add: updated value ['top', 'pilotObject', 'domainRelatedObject', 'nisDomainObject', 'domain'] 2024-12-04T14:25:59Z DEBUG add: 'domainRelatedObject' to objectClass, current value ['top', 'pilotObject', 'domainRelatedObject', 'nisDomainObject', 'domain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['top', 'pilotObject', 'nisDomainObject', 'domain', 'domainRelatedObject'] 2024-12-04T14:25:59Z DEBUG add: 'nisDomainObject' to objectClass, current value ['top', 'pilotObject', 'nisDomainObject', 'domain', 'domainRelatedObject'] 2024-12-04T14:25:59Z DEBUG add: updated value ['top', 'pilotObject', 'domain', 'domainRelatedObject', 'nisDomainObject'] 2024-12-04T14:25:59Z DEBUG add: 'freeipa.testdomain' to associatedDomain, current value ['freeipa.testdomain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['freeipa.testdomain'] 2024-12-04T14:25:59Z DEBUG add: 'freeipa.testdomain' to nisDomain, current value ['freeipa.testdomain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['freeipa.testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG pilotObject 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG domainRelatedObject 2024-12-04T14:25:59Z DEBUG nisDomainObject 2024-12-04T14:25:59Z DEBUG dc: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG info: 2024-12-04T14:25:59Z DEBUG IPA V2.0 2024-12-04T14:25:59Z DEBUG nisDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG associatedDomain: 2024-12-04T14:25:59Z DEBUG freeipa.testdomain 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:25:59Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG organizationalUnit 2024-12-04T14:25:59Z DEBUG ou: 2024-12-04T14:25:59Z DEBUG profiles 2024-12-04T14:25:59Z DEBUG profile 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "attributemap || authenticationmethod || bindtimelimit || cn || createtimestamp || credentiallevel || defaultsearchbase || defaultsearchscope || defaultserverlist || dereferencealiases || entryusn || followreferrals || modifytimestamp || objectclass || objectclassmap || ou || preferredserverlist || profilettl || searchtimelimit || serviceauthenticationmethod || servicecredentiallevel || servicesearchdescriptor")(targetfilter = "(|(objectclass=organizationalUnit)(objectclass=DUAConfigProfile))")(version 3.0;acl "permission:System: Read DUA Profile";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG add: 'top' to objectClass, current value ['top', 'organizationalUnit'] 2024-12-04T14:25:59Z DEBUG add: updated value ['organizationalUnit', 'top'] 2024-12-04T14:25:59Z DEBUG add: 'organizationalUnit' to objectClass, current value ['organizationalUnit', 'top'] 2024-12-04T14:25:59Z DEBUG add: updated value ['top', 'organizationalUnit'] 2024-12-04T14:25:59Z DEBUG add: 'profiles' to ou, current value ['profiles', 'profile'] 2024-12-04T14:25:59Z DEBUG add: updated value ['profile', 'profiles'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG organizationalUnit 2024-12-04T14:25:59Z DEBUG ou: 2024-12-04T14:25:59Z DEBUG profile 2024-12-04T14:25:59Z DEBUG profiles 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "attributemap || authenticationmethod || bindtimelimit || cn || createtimestamp || credentiallevel || defaultsearchbase || defaultsearchscope || defaultserverlist || dereferencealiases || entryusn || followreferrals || modifytimestamp || objectclass || objectclassmap || ou || preferredserverlist || profilettl || searchtimelimit || serviceauthenticationmethod || servicecredentiallevel || servicesearchdescriptor")(targetfilter = "(|(objectclass=organizationalUnit)(objectclass=DUAConfigProfile))")(version 3.0;acl "permission:System: Read DUA Profile";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=default,ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=default,ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG DUAConfigProfile 2024-12-04T14:25:59Z DEBUG defaultServerList: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG defaultSearchBase: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG authenticationMethod: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG searchTimeLimit: 2024-12-04T14:25:59Z DEBUG 15 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG default 2024-12-04T14:25:59Z DEBUG serviceSearchDescriptor: 2024-12-04T14:25:59Z DEBUG passwd:cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG group:cn=groups,cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG bindTimeLimit: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG objectclassMap: 2024-12-04T14:25:59Z DEBUG shadow:shadowAccount=posixAccount 2024-12-04T14:25:59Z DEBUG followReferrals: 2024-12-04T14:25:59Z DEBUG TRUE 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=default,ou=profile,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG DUAConfigProfile 2024-12-04T14:25:59Z DEBUG defaultServerList: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG defaultSearchBase: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG authenticationMethod: 2024-12-04T14:25:59Z DEBUG none 2024-12-04T14:25:59Z DEBUG searchTimeLimit: 2024-12-04T14:25:59Z DEBUG 15 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG default 2024-12-04T14:25:59Z DEBUG serviceSearchDescriptor: 2024-12-04T14:25:59Z DEBUG passwd:cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG group:cn=groups,cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG bindTimeLimit: 2024-12-04T14:25:59Z DEBUG 5 2024-12-04T14:25:59Z DEBUG objectclassMap: 2024-12-04T14:25:59Z DEBUG shadow:shadowAccount=posixAccount 2024-12-04T14:25:59Z DEBUG followReferrals: 2024-12-04T14:25:59Z DEBUG TRUE 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-nss_ldap.update 0.014 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-replication.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=replication,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=replication,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsDS5Replica 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsDS5ReplicaId: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG nsDS5ReplicaRoot: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG replication 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicachangecount || nsds5replicacleanruv || nsds5replicaid || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicatombstonepurgeinterval || nsds5replicatype || nsds5task || nsstate || objectclass")(targetfilter = "(objectclass=nsds5replica)")(version 3.0;acl "permission:System: Read Replication Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=replication,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG nsDS5Replica 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsDS5ReplicaId: 2024-12-04T14:25:59Z DEBUG 3 2024-12-04T14:25:59Z DEBUG nsDS5ReplicaRoot: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG replication 2024-12-04T14:25:59Z DEBUG aci: 2024-12-04T14:25:59Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicachangecount || nsds5replicacleanruv || nsds5replicaid || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicatombstonepurgeinterval || nsds5replicatype || nsds5task || nsstate || objectclass")(targetfilter = "(objectclass=nsds5replica)")(version 3.0;acl "permission:System: Read Replication Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupofnames 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG replication managers 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG krbprincipalname=ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG add: 'krbprincipalname=ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['krbprincipalname=ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['krbprincipalname=ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG groupofnames 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG replication managers 2024-12-04T14:25:59Z DEBUG member: 2024-12-04T14:25:59Z DEBUG krbprincipalname=ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG topology 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG topology 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=domain,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=domain,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG iparepltopoconf 2024-12-04T14:25:59Z DEBUG ipaReplTopoConfRoot: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsDS5ReplicatedAttributeList: 2024-12-04T14:25:59Z DEBUG (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime 2024-12-04T14:25:59Z DEBUG nsDS5ReplicatedAttributeListTotal: 2024-12-04T14:25:59Z DEBUG (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime 2024-12-04T14:25:59Z DEBUG nsds5ReplicaStripAttrs: 2024-12-04T14:25:59Z DEBUG modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG add: '(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime' to nsDS5ReplicatedAttributeList, current value ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'] 2024-12-04T14:25:59Z DEBUG add: '(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime' to nsDS5ReplicatedAttributeListTotal, current value ['(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'] 2024-12-04T14:25:59Z DEBUG add: updated value ['(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'] 2024-12-04T14:25:59Z DEBUG add: 'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp' to nsds5ReplicaStripAttrs, current value ['modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'] 2024-12-04T14:25:59Z DEBUG add: updated value ['modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=domain,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG iparepltopoconf 2024-12-04T14:25:59Z DEBUG ipaReplTopoConfRoot: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsDS5ReplicatedAttributeList: 2024-12-04T14:25:59Z DEBUG (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime 2024-12-04T14:25:59Z DEBUG nsDS5ReplicatedAttributeListTotal: 2024-12-04T14:25:59Z DEBUG (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime 2024-12-04T14:25:59Z DEBUG nsds5ReplicaStripAttrs: 2024-12-04T14:25:59Z DEBUG modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG domain 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Deleting entry cn=realm,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG cn=realm,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain did not exist:no such entry 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:25:59Z DEBUG ipaConfigObject 2024-12-04T14:25:59Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG o=ipaca 2024-12-04T14:25:59Z DEBUG ipaMinDomainLevel: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG add: 'ipaReplTopoManagedServer' to objectclass, current value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig'] 2024-12-04T14:25:59Z DEBUG add: updated value ['top', 'nsContainer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig', 'ipaReplTopoManagedServer'] 2024-12-04T14:25:59Z DEBUG add: 'dc=freeipa,dc=testdomain' to ipaReplTopoManagedSuffix, current value ['dc=freeipa,dc=testdomain', 'o=ipaca'] 2024-12-04T14:25:59Z DEBUG add: updated value ['o=ipaca', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsContainer 2024-12-04T14:25:59Z DEBUG ipaConfigObject 2024-12-04T14:25:59Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:25:59Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG dc.freeipa.testdomain 2024-12-04T14:25:59Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:25:59Z DEBUG o=ipaca 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG ipaMinDomainLevel: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:25:59Z DEBUG 1 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=IPA Topology Configuration,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=IPA Topology Configuration,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG IPA Topology Configuration 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG ipa-topology-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG ipa-topology-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG ipa_topo_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libtopology 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 1.0 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-binddngroup: 2024-12-04T14:25:59Z DEBUG cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-config-base: 2024-12-04T14:25:59Z DEBUG cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-replica-root: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG o=ipaca 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-startup-delay: 2024-12-04T14:25:59Z DEBUG 20 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=IPA Topology Configuration,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG IPA Topology Configuration 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG ldbm database 2024-12-04T14:25:59Z DEBUG Multisupplier Replication Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG ipa-topology-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG ipa-topology-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG ipa_topo_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libtopology 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG freeipa 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 1.0 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-binddngroup: 2024-12-04T14:25:59Z DEBUG cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-config-base: 2024-12-04T14:25:59Z DEBUG cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-shared-replica-root: 2024-12-04T14:25:59Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG o=ipaca 2024-12-04T14:25:59Z DEBUG nsslapd-topo-plugin-startup-delay: 2024-12-04T14:25:59Z DEBUG 20 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-replication.update 0.017 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-sslciphers.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=encryption,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=encryption,cn=config 2024-12-04T14:25:59Z DEBUG CACertExtractFile: 2024-12-04T14:25:59Z DEBUG /tmp/slapd-FREEIPA-TESTDOMAIN/FREEIPA.TESTDOMAIN20IPA20CA.pem 2024-12-04T14:25:59Z DEBUG allowWeakCipher: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG encryption 2024-12-04T14:25:59Z DEBUG nsSSL3Ciphers: 2024-12-04T14:25:59Z DEBUG default 2024-12-04T14:25:59Z DEBUG nsSSLClientAuth: 2024-12-04T14:25:59Z DEBUG allowed 2024-12-04T14:25:59Z DEBUG nsSSLSessionTimeout: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsEncryptionConfig 2024-12-04T14:25:59Z DEBUG nsSSLSupportedCiphers: 2024-12-04T14:25:59Z DEBUG TLS_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_SEED_CBC_SHA::SEED::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_SHA256::NULL::SHA256::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_MD5::NULL::MD5::0 2024-12-04T14:25:59Z DEBUG only: set nsSSL3Ciphers to 'default', current value ['default'] 2024-12-04T14:25:59Z DEBUG only: updated value ['default'] 2024-12-04T14:25:59Z DEBUG addifnew: 'off' to allowWeakCipher, current value ['off'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=encryption,cn=config 2024-12-04T14:25:59Z DEBUG CACertExtractFile: 2024-12-04T14:25:59Z DEBUG /tmp/slapd-FREEIPA-TESTDOMAIN/FREEIPA.TESTDOMAIN20IPA20CA.pem 2024-12-04T14:25:59Z DEBUG allowWeakCipher: 2024-12-04T14:25:59Z DEBUG off 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG encryption 2024-12-04T14:25:59Z DEBUG nsSSL3Ciphers: 2024-12-04T14:25:59Z DEBUG default 2024-12-04T14:25:59Z DEBUG nsSSLClientAuth: 2024-12-04T14:25:59Z DEBUG allowed 2024-12-04T14:25:59Z DEBUG nsSSLSessionTimeout: 2024-12-04T14:25:59Z DEBUG 0 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsEncryptionConfig 2024-12-04T14:25:59Z DEBUG nsSSLSupportedCiphers: 2024-12-04T14:25:59Z DEBUG TLS_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384::AES::SHA384::256 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256::CHACHA20POLY1305::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_CBC_SHA::AES::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_128_CBC_SHA256::AES::SHA256::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_CAMELLIA_128_CBC_SHA::CAMELLIA::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_CBC_SHA::AES::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_AES_256_CBC_SHA256::AES::SHA256::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_CAMELLIA_256_CBC_SHA::CAMELLIA::SHA1::256 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_SEED_CBC_SHA::SEED::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_3DES_EDE_CBC_SHA::3DES::SHA1::192 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_RC4_128_SHA::RC4::SHA1::128 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128 2024-12-04T14:25:59Z DEBUG TLS_DHE_RSA_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_DHE_DSS_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_DES_CBC_SHA::DES::SHA1::64 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_ECDSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDHE_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDH_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_ECDH_ECDSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_SHA::NULL::SHA1::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_SHA256::NULL::SHA256::0 2024-12-04T14:25:59Z DEBUG TLS_RSA_WITH_NULL_MD5::NULL::MD5::0 2024-12-04T14:25:59Z DEBUG [] 2024-12-04T14:25:59Z DEBUG Updated 0 2024-12-04T14:25:59Z DEBUG Done 2024-12-04T14:25:59Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-sslciphers.update 0.009 sec 2024-12-04T14:25:59Z DEBUG Parsing update file '/usr/share/ipa/updates/20-syncrepl.update' 2024-12-04T14:25:59Z DEBUG Updating existing entry: cn=Retro Changelog Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Initial value 2024-12-04T14:25:59Z DEBUG dn: cn=Retro Changelog Plugin,cn=plugins,cn=config 2024-12-04T14:25:59Z DEBUG cn: 2024-12-04T14:25:59Z DEBUG Retro Changelog Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-attribute: 2024-12-04T14:25:59Z DEBUG nsuniqueid:targetUniqueId 2024-12-04T14:25:59Z DEBUG nsslapd-changelogmaxage: 2024-12-04T14:25:59Z DEBUG 2d 2024-12-04T14:25:59Z DEBUG nsslapd-include-suffix: 2024-12-04T14:25:59Z DEBUG cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:25:59Z DEBUG Class of Service 2024-12-04T14:25:59Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:25:59Z DEBUG database 2024-12-04T14:25:59Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:25:59Z DEBUG Retrocl Plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginId: 2024-12-04T14:25:59Z DEBUG retrocl 2024-12-04T14:25:59Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:25:59Z DEBUG retrocl_plugin_init 2024-12-04T14:25:59Z DEBUG nsslapd-pluginPath: 2024-12-04T14:25:59Z DEBUG libretrocl-plugin 2024-12-04T14:25:59Z DEBUG nsslapd-pluginType: 2024-12-04T14:25:59Z DEBUG object 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:25:59Z DEBUG 389 Project 2024-12-04T14:25:59Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:25:59Z DEBUG 2.4.6 2024-12-04T14:25:59Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:25:59Z DEBUG on 2024-12-04T14:25:59Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:25:59Z DEBUG 25 2024-12-04T14:25:59Z DEBUG objectClass: 2024-12-04T14:25:59Z DEBUG top 2024-12-04T14:25:59Z DEBUG nsSlapdPlugin 2024-12-04T14:25:59Z DEBUG extensibleObject 2024-12-04T14:25:59Z DEBUG only: set nsslapd-pluginEnabled to 'on', current value ['on'] 2024-12-04T14:25:59Z DEBUG only: updated value ['on'] 2024-12-04T14:25:59Z DEBUG add: 'nsuniqueid:targetUniqueId' to nsslapd-attribute, current value ['nsuniqueid:targetUniqueId'] 2024-12-04T14:25:59Z DEBUG add: updated value ['nsuniqueid:targetUniqueId'] 2024-12-04T14:25:59Z DEBUG add: '2d' to nsslapd-changelogmaxage, current value ['2d'] 2024-12-04T14:25:59Z DEBUG add: updated value ['2d'] 2024-12-04T14:25:59Z DEBUG add: 'cn=dns,dc=freeipa,dc=testdomain' to nsslapd-include-suffix, current value ['cn=dns,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG add: updated value ['cn=dns,dc=freeipa,dc=testdomain'] 2024-12-04T14:25:59Z DEBUG --------------------------------------------- 2024-12-04T14:25:59Z DEBUG Final value after applying updates 2024-12-04T14:25:59Z DEBUG dn: cn=Retro Changelog Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Retro Changelog Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-attribute: 2024-12-04T14:26:00Z DEBUG nsuniqueid:targetUniqueId 2024-12-04T14:26:00Z DEBUG nsslapd-changelogmaxage: 2024-12-04T14:26:00Z DEBUG 2d 2024-12-04T14:26:00Z DEBUG nsslapd-include-suffix: 2024-12-04T14:26:00Z DEBUG cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:26:00Z DEBUG Class of Service 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG Retrocl Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG retrocl 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG retrocl_plugin_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libretrocl-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG object 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:00Z DEBUG 25 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG MemberOf Plugin 2024-12-04T14:26:00Z DEBUG memberofattr: 2024-12-04T14:26:00Z DEBUG memberOf 2024-12-04T14:26:00Z DEBUG memberofentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:26:00Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberofgroupattr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG memberUser 2024-12-04T14:26:00Z DEBUG memberHost 2024-12-04T14:26:00Z DEBUG ipaOwner 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG memberof plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG memberof 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG memberof_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libmemberof-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG add: 'dc=freeipa,dc=testdomain' to memberofentryscope, current value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: 'cn=compat,dc=freeipa,dc=testdomain' to memberofentryscopeexcludesubtree, current value ['cn=compat,dc=freeipa,dc=testdomain', 'cn=provisioning,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=provisioning,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: 'cn=provisioning,dc=freeipa,dc=testdomain' to memberofentryscopeexcludesubtree, current value ['cn=provisioning,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain', 'cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to memberofentryscopeexcludesubtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=compat,dc=freeipa,dc=testdomain', 'cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=compat,dc=freeipa,dc=testdomain', 'cn=provisioning,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG MemberOf Plugin 2024-12-04T14:26:00Z DEBUG memberofattr: 2024-12-04T14:26:00Z DEBUG memberOf 2024-12-04T14:26:00Z DEBUG memberofentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:26:00Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberofgroupattr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG memberUser 2024-12-04T14:26:00Z DEBUG memberHost 2024-12-04T14:26:00Z DEBUG ipaOwner 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG memberof plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG memberof 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG memberof_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libmemberof-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG referential integrity postoperation 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG referential integrity plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG referint 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG referint_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libreferint-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG referint-logfile: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:26:00Z DEBUG referint-membership-attr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG uniquemember 2024-12-04T14:26:00Z DEBUG owner 2024-12-04T14:26:00Z DEBUG seeAlso 2024-12-04T14:26:00Z DEBUG manager 2024-12-04T14:26:00Z DEBUG secretary 2024-12-04T14:26:00Z DEBUG memberuser 2024-12-04T14:26:00Z DEBUG memberhost 2024-12-04T14:26:00Z DEBUG sourcehost 2024-12-04T14:26:00Z DEBUG memberservice 2024-12-04T14:26:00Z DEBUG managedby 2024-12-04T14:26:00Z DEBUG memberallowcmd 2024-12-04T14:26:00Z DEBUG memberdenycmd 2024-12-04T14:26:00Z DEBUG ipasudorunas 2024-12-04T14:26:00Z DEBUG ipasudorunasgroup 2024-12-04T14:26:00Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:26:00Z DEBUG ipaassignedidview 2024-12-04T14:26:00Z DEBUG ipaallowedtarget 2024-12-04T14:26:00Z DEBUG ipamemberca 2024-12-04T14:26:00Z DEBUG ipamembercertprofile 2024-12-04T14:26:00Z DEBUG ipalocation 2024-12-04T14:26:00Z DEBUG membermanager 2024-12-04T14:26:00Z DEBUG ipaowner 2024-12-04T14:26:00Z DEBUG ipaidpconfiglink 2024-12-04T14:26:00Z DEBUG referint-update-delay: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG add: 'dc=freeipa,dc=testdomain' to nsslapd-plugincontainerscope, current value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: 'dc=freeipa,dc=testdomain' to nsslapd-pluginentryscope, current value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: 'cn=provisioning,dc=freeipa,dc=testdomain' to nsslapd-pluginExcludeEntryScope, current value ['cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG referential integrity postoperation 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG referential integrity plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG referint 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG referint_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libreferint-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG referint-logfile: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:26:00Z DEBUG referint-membership-attr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG uniquemember 2024-12-04T14:26:00Z DEBUG owner 2024-12-04T14:26:00Z DEBUG seeAlso 2024-12-04T14:26:00Z DEBUG manager 2024-12-04T14:26:00Z DEBUG secretary 2024-12-04T14:26:00Z DEBUG memberuser 2024-12-04T14:26:00Z DEBUG memberhost 2024-12-04T14:26:00Z DEBUG sourcehost 2024-12-04T14:26:00Z DEBUG memberservice 2024-12-04T14:26:00Z DEBUG managedby 2024-12-04T14:26:00Z DEBUG memberallowcmd 2024-12-04T14:26:00Z DEBUG memberdenycmd 2024-12-04T14:26:00Z DEBUG ipasudorunas 2024-12-04T14:26:00Z DEBUG ipasudorunasgroup 2024-12-04T14:26:00Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:26:00Z DEBUG ipaassignedidview 2024-12-04T14:26:00Z DEBUG ipaallowedtarget 2024-12-04T14:26:00Z DEBUG ipamemberca 2024-12-04T14:26:00Z DEBUG ipamembercertprofile 2024-12-04T14:26:00Z DEBUG ipalocation 2024-12-04T14:26:00Z DEBUG membermanager 2024-12-04T14:26:00Z DEBUG ipaowner 2024-12-04T14:26:00Z DEBUG ipaidpconfiglink 2024-12-04T14:26:00Z DEBUG referint-update-delay: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Content Synchronization,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Content Synchronization,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Content Synchronization 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:26:00Z DEBUG Retro Changelog Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG Context Synchronization (RFC4533) plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG content-sync-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG sync_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libcontentsync-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG object 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG only: set nsslapd-pluginEnabled to 'on', current value ['on'] 2024-12-04T14:26:00Z DEBUG only: updated value ['on'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Content Synchronization,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Content Synchronization 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-named: 2024-12-04T14:26:00Z DEBUG Retro Changelog Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG Context Synchronization (RFC4533) plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG content-sync-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG sync_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libcontentsync-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG object 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=IPA Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=IPA Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG IPA Unique IDs 2024-12-04T14:26:00Z DEBUG ipauuidattr: 2024-12-04T14:26:00Z DEBUG ipaUniqueID 2024-12-04T14:26:00Z DEBUG ipauuidenforce: 2024-12-04T14:26:00Z DEBUG TRUE 2024-12-04T14:26:00Z DEBUG ipauuidexcludesubtree: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG ipauuidfilter: 2024-12-04T14:26:00Z DEBUG (|(objectclass=ipaObject)(objectclass=ipaAssociation)) 2024-12-04T14:26:00Z DEBUG ipauuidmagicregen: 2024-12-04T14:26:00Z DEBUG autogenerate 2024-12-04T14:26:00Z DEBUG ipauuidscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG add: 'cn=provisioning,dc=freeipa,dc=testdomain' to ipaUuidExcludeSubtree, current value ['cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=provisioning,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=IPA Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG IPA Unique IDs 2024-12-04T14:26:00Z DEBUG ipauuidattr: 2024-12-04T14:26:00Z DEBUG ipaUniqueID 2024-12-04T14:26:00Z DEBUG ipauuidenforce: 2024-12-04T14:26:00Z DEBUG TRUE 2024-12-04T14:26:00Z DEBUG ipauuidexcludesubtree: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG ipauuidfilter: 2024-12-04T14:26:00Z DEBUG (|(objectclass=ipaObject)(objectclass=ipaAssociation)) 2024-12-04T14:26:00Z DEBUG ipauuidmagicregen: 2024-12-04T14:26:00Z DEBUG autogenerate 2024-12-04T14:26:00Z DEBUG ipauuidscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-syncrepl.update 0.023 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/20-user_private_groups.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG mepTemplateEntry 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Template 2024-12-04T14:26:00Z DEBUG mepRDNAttr: 2024-12-04T14:26:00Z DEBUG cn 2024-12-04T14:26:00Z DEBUG mepStaticAttr: 2024-12-04T14:26:00Z DEBUG objectclass: posixgroup 2024-12-04T14:26:00Z DEBUG objectclass: ipaobject 2024-12-04T14:26:00Z DEBUG ipaUniqueId: autogenerate 2024-12-04T14:26:00Z DEBUG mepMappedAttr: 2024-12-04T14:26:00Z DEBUG cn: $uid 2024-12-04T14:26:00Z DEBUG gidNumber: $uidNumber 2024-12-04T14:26:00Z DEBUG description: User private group for $uid 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG mepTemplateEntry 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Template 2024-12-04T14:26:00Z DEBUG mepRDNAttr: 2024-12-04T14:26:00Z DEBUG cn 2024-12-04T14:26:00Z DEBUG mepStaticAttr: 2024-12-04T14:26:00Z DEBUG objectclass: posixgroup 2024-12-04T14:26:00Z DEBUG objectclass: ipaobject 2024-12-04T14:26:00Z DEBUG ipaUniqueId: autogenerate 2024-12-04T14:26:00Z DEBUG mepMappedAttr: 2024-12-04T14:26:00Z DEBUG cn: $uid 2024-12-04T14:26:00Z DEBUG gidNumber: $uidNumber 2024-12-04T14:26:00Z DEBUG description: User private group for $uid 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Definition 2024-12-04T14:26:00Z DEBUG originScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG originFilter: 2024-12-04T14:26:00Z DEBUG (&(objectclass=posixAccount)(!(description=__no_upg__))) 2024-12-04T14:26:00Z DEBUG managedBase: 2024-12-04T14:26:00Z DEBUG cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG managedTemplate: 2024-12-04T14:26:00Z DEBUG cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Definition 2024-12-04T14:26:00Z DEBUG originScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG originFilter: 2024-12-04T14:26:00Z DEBUG (&(objectclass=posixAccount)(!(description=__no_upg__))) 2024-12-04T14:26:00Z DEBUG managedBase: 2024-12-04T14:26:00Z DEBUG cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG managedTemplate: 2024-12-04T14:26:00Z DEBUG cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Definition 2024-12-04T14:26:00Z DEBUG originScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG originFilter: 2024-12-04T14:26:00Z DEBUG (&(objectclass=posixAccount)(!(description=__no_upg__))) 2024-12-04T14:26:00Z DEBUG managedBase: 2024-12-04T14:26:00Z DEBUG cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG managedTemplate: 2024-12-04T14:26:00Z DEBUG cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG replace: objectclass=posixAccount not found, skipping 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG UPG Definition 2024-12-04T14:26:00Z DEBUG originScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG originFilter: 2024-12-04T14:26:00Z DEBUG (&(objectclass=posixAccount)(!(description=__no_upg__))) 2024-12-04T14:26:00Z DEBUG managedBase: 2024-12-04T14:26:00Z DEBUG cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG managedTemplate: 2024-12-04T14:26:00Z DEBUG cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-user_private_groups.update 0.008 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/20-uuid.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=IPK11 Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=IPK11 Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG IPK11 Unique IDs 2024-12-04T14:26:00Z DEBUG ipauuidattr: 2024-12-04T14:26:00Z DEBUG ipk11UniqueID 2024-12-04T14:26:00Z DEBUG ipauuidenforce: 2024-12-04T14:26:00Z DEBUG FALSE 2024-12-04T14:26:00Z DEBUG ipauuidfilter: 2024-12-04T14:26:00Z DEBUG (objectclass=ipk11Object) 2024-12-04T14:26:00Z DEBUG ipauuidmagicregen: 2024-12-04T14:26:00Z DEBUG autogenerate 2024-12-04T14:26:00Z DEBUG ipauuidscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=IPK11 Unique IDs,cn=IPA UUID,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG IPK11 Unique IDs 2024-12-04T14:26:00Z DEBUG ipauuidattr: 2024-12-04T14:26:00Z DEBUG ipk11UniqueID 2024-12-04T14:26:00Z DEBUG ipauuidenforce: 2024-12-04T14:26:00Z DEBUG FALSE 2024-12-04T14:26:00Z DEBUG ipauuidfilter: 2024-12-04T14:26:00Z DEBUG (objectclass=ipk11Object) 2024-12-04T14:26:00Z DEBUG ipauuidmagicregen: 2024-12-04T14:26:00Z DEBUG autogenerate 2024-12-04T14:26:00Z DEBUG ipauuidscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-uuid.update 0.003 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/20-whoami.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=whoami,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=whoami,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG whoami 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG whoami extended operation plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG whoami-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG whoami_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libwhoami-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG extendedop 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=whoami,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG whoami 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG whoami extended operation plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG whoami-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG whoami_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libwhoami-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG extendedop 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/20-whoami.update 0.004 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/21-ca_renewal_container.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ca_renewal 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Add CA Certificate For Renewal";allow (add) groupdn = "ldap:///cn=System: Add CA Certificate For Renewal,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Modify CA Certificate For Renewal";allow (write) groupdn = "ldap:///cn=System: Modify CA Certificate For Renewal,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Read CA Renewal Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG add: 'top' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: 'nsContainer' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['top', 'nsContainer'] 2024-12-04T14:26:00Z DEBUG add: 'ca_renewal' to cn, current value ['ca_renewal'] 2024-12-04T14:26:00Z DEBUG add: updated value ['ca_renewal'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ca_renewal 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Add CA Certificate For Renewal";allow (add) groupdn = "ldap:///cn=System: Add CA Certificate For Renewal,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Modify CA Certificate For Renewal";allow (write) groupdn = "ldap:///cn=System: Modify CA Certificate For Renewal,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Read CA Renewal Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/21-ca_renewal_container.update 0.003 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/21-certstore_container.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificates 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG add: 'top' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: 'nsContainer' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['top', 'nsContainer'] 2024-12-04T14:26:00Z DEBUG add: 'certificates' to cn, current value ['certificates'] 2024-12-04T14:26:00Z DEBUG add: updated value ['certificates'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificates 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/21-certstore_container.update 0.002 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/21-replicas_container.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG replicas 2024-12-04T14:26:00Z DEBUG add: 'top' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: 'nsContainer' to objectClass, current value ['nsContainer', 'top'] 2024-12-04T14:26:00Z DEBUG add: updated value ['top', 'nsContainer'] 2024-12-04T14:26:00Z DEBUG add: 'replicas' to cn, current value ['replicas'] 2024-12-04T14:26:00Z DEBUG add: updated value ['replicas'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=replicas,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG replicas 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/21-replicas_container.update 0.002 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/25-referint.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG referential integrity postoperation 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG referential integrity plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG referint 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG referint_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libreferint-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG referint-logfile: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:26:00Z DEBUG referint-membership-attr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG uniquemember 2024-12-04T14:26:00Z DEBUG owner 2024-12-04T14:26:00Z DEBUG seeAlso 2024-12-04T14:26:00Z DEBUG manager 2024-12-04T14:26:00Z DEBUG secretary 2024-12-04T14:26:00Z DEBUG memberuser 2024-12-04T14:26:00Z DEBUG memberhost 2024-12-04T14:26:00Z DEBUG sourcehost 2024-12-04T14:26:00Z DEBUG memberservice 2024-12-04T14:26:00Z DEBUG managedby 2024-12-04T14:26:00Z DEBUG memberallowcmd 2024-12-04T14:26:00Z DEBUG memberdenycmd 2024-12-04T14:26:00Z DEBUG ipasudorunas 2024-12-04T14:26:00Z DEBUG ipasudorunasgroup 2024-12-04T14:26:00Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:26:00Z DEBUG ipaassignedidview 2024-12-04T14:26:00Z DEBUG ipaallowedtarget 2024-12-04T14:26:00Z DEBUG ipamemberca 2024-12-04T14:26:00Z DEBUG ipamembercertprofile 2024-12-04T14:26:00Z DEBUG ipalocation 2024-12-04T14:26:00Z DEBUG membermanager 2024-12-04T14:26:00Z DEBUG ipaowner 2024-12-04T14:26:00Z DEBUG ipaidpconfiglink 2024-12-04T14:26:00Z DEBUG referint-update-delay: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG add: 'manager' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager'] 2024-12-04T14:26:00Z DEBUG add: 'secretary' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary'] 2024-12-04T14:26:00Z DEBUG add: 'memberuser' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser'] 2024-12-04T14:26:00Z DEBUG add: 'memberhost' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost'] 2024-12-04T14:26:00Z DEBUG add: 'sourcehost' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost'] 2024-12-04T14:26:00Z DEBUG add: 'memberservice' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice'] 2024-12-04T14:26:00Z DEBUG add: 'managedby' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby'] 2024-12-04T14:26:00Z DEBUG add: 'memberallowcmd' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd'] 2024-12-04T14:26:00Z DEBUG add: 'memberdenycmd' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd'] 2024-12-04T14:26:00Z DEBUG add: 'ipasudorunas' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas'] 2024-12-04T14:26:00Z DEBUG add: 'ipasudorunasgroup' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup'] 2024-12-04T14:26:00Z DEBUG add: 'ipatokenradiusconfiglink' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink'] 2024-12-04T14:26:00Z DEBUG add: 'ipaassignedidview' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview'] 2024-12-04T14:26:00Z DEBUG add: 'ipaallowedtarget' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget'] 2024-12-04T14:26:00Z DEBUG add: 'ipamemberca' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca'] 2024-12-04T14:26:00Z DEBUG add: 'ipamembercertprofile' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile'] 2024-12-04T14:26:00Z DEBUG add: 'ipalocation' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation'] 2024-12-04T14:26:00Z DEBUG add: 'membermanager' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'membermanager', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager'] 2024-12-04T14:26:00Z DEBUG add: 'ipaowner' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaowner', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner'] 2024-12-04T14:26:00Z DEBUG add: 'ipaidpconfiglink' to referint-membership-attr, current value ['member', 'uniquemember', 'owner', 'seeAlso', 'ipaidpconfiglink', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner'] 2024-12-04T14:26:00Z DEBUG add: updated value ['member', 'uniquemember', 'owner', 'seeAlso', 'manager', 'secretary', 'memberuser', 'memberhost', 'sourcehost', 'memberservice', 'managedby', 'memberallowcmd', 'memberdenycmd', 'ipasudorunas', 'ipasudorunasgroup', 'ipatokenradiusconfiglink', 'ipaassignedidview', 'ipaallowedtarget', 'ipamemberca', 'ipamembercertprofile', 'ipalocation', 'membermanager', 'ipaowner', 'ipaidpconfiglink'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=referential integrity postoperation,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG referential integrity postoperation 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG referential integrity plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG referint 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG referint_postop_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libreferint-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpostoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-plugincontainerscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginentryscope: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginexcludeentryscope: 2024-12-04T14:26:00Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG referint-logfile: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/referint 2024-12-04T14:26:00Z DEBUG referint-membership-attr: 2024-12-04T14:26:00Z DEBUG member 2024-12-04T14:26:00Z DEBUG uniquemember 2024-12-04T14:26:00Z DEBUG owner 2024-12-04T14:26:00Z DEBUG seeAlso 2024-12-04T14:26:00Z DEBUG manager 2024-12-04T14:26:00Z DEBUG secretary 2024-12-04T14:26:00Z DEBUG memberuser 2024-12-04T14:26:00Z DEBUG memberhost 2024-12-04T14:26:00Z DEBUG sourcehost 2024-12-04T14:26:00Z DEBUG memberservice 2024-12-04T14:26:00Z DEBUG managedby 2024-12-04T14:26:00Z DEBUG memberallowcmd 2024-12-04T14:26:00Z DEBUG memberdenycmd 2024-12-04T14:26:00Z DEBUG ipasudorunas 2024-12-04T14:26:00Z DEBUG ipasudorunasgroup 2024-12-04T14:26:00Z DEBUG ipatokenradiusconfiglink 2024-12-04T14:26:00Z DEBUG ipaassignedidview 2024-12-04T14:26:00Z DEBUG ipaallowedtarget 2024-12-04T14:26:00Z DEBUG ipamemberca 2024-12-04T14:26:00Z DEBUG ipamembercertprofile 2024-12-04T14:26:00Z DEBUG ipalocation 2024-12-04T14:26:00Z DEBUG membermanager 2024-12-04T14:26:00Z DEBUG ipaowner 2024-12-04T14:26:00Z DEBUG ipaidpconfiglink 2024-12-04T14:26:00Z DEBUG referint-update-delay: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/25-referint.update 0.008 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/30-ipservices.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipservices,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipservices,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipservices 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipservices,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipservices 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/30-ipservices.update 0.002 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/30-provisioning.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG provisioning 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG provisioning 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG accounts 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG accounts 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG staged users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG staged users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG deleted users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG deleted users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG staged users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG remove: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) userdn = "ldap:///uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) userdn = "ldap:///uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG staged users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Add Stage User";allow (add) groupdn = "ldap:///cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Modify Stage User";allow (write) groupdn = "ldap:///cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage User password";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Read Stage Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG deleted users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG remove: '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) userdn = "ldap:///uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) userdn = "ldap:///uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: '(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG deleted users 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Preserved Users";allow (write) groupdn = "ldap:///cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read Preserved Users";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=provisioning accounts lock,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=provisioning accounts lock,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cosSuperDefinition 2024-12-04T14:26:00Z DEBUG cosPointerDefinition 2024-12-04T14:26:00Z DEBUG ldapSubEntry 2024-12-04T14:26:00Z DEBUG costemplatedn: 2024-12-04T14:26:00Z DEBUG cn=Inactivation cos template,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cosAttribute: 2024-12-04T14:26:00Z DEBUG nsaccountlock operational 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG provisioning accounts lock 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=provisioning accounts lock,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cosSuperDefinition 2024-12-04T14:26:00Z DEBUG cosPointerDefinition 2024-12-04T14:26:00Z DEBUG ldapSubEntry 2024-12-04T14:26:00Z DEBUG costemplatedn: 2024-12-04T14:26:00Z DEBUG cn=Inactivation cos template,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cosAttribute: 2024-12-04T14:26:00Z DEBUG nsaccountlock operational 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG provisioning accounts lock 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Inactivation cos template,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Inactivation cos template,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG cosTemplate 2024-12-04T14:26:00Z DEBUG cosPriority: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Inactivation cos template 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Inactivation cos template,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG cosTemplate 2024-12-04T14:26:00Z DEBUG cosPriority: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Inactivation cos template 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/30-provisioning.update 0.018 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/30-s4u2proxy.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG s4u2proxy 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Add Service Delegations";allow (add) groupdn = "ldap:///cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaallowedtarget || memberprincipal")(targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Modify Service Delegation Membership";allow (write) groupdn = "ldap:///cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaallowedtarget || memberprincipal || modifytimestamp || objectclass")(targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Read Service Delegations";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Remove Service Delegations";allow (delete) groupdn = "ldap:///cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG s4u2proxy 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Add Service Delegations";allow (add) groupdn = "ldap:///cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaallowedtarget || memberprincipal")(targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Modify Service Delegation Membership";allow (write) groupdn = "ldap:///cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaallowedtarget || memberprincipal || modifytimestamp || objectclass")(targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Read Service Delegations";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=groupofprincipals)")(version 3.0;acl "permission:System: Remove Service Delegations";allow (delete) groupdn = "ldap:///cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-http-delegation 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:00Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-http-delegation 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:00Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-ldap-delegation-targets 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-ldap-delegation-targets 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-http-delegation 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:00Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG add: 'HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN' to memberPrincipal, current value ['HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN'] 2024-12-04T14:26:00Z DEBUG add: updated value ['HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-http-delegation 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:00Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-ldap-delegation-targets 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG add: 'ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN' to memberPrincipal, current value ['ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN'] 2024-12-04T14:26:00Z DEBUG add: updated value ['ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupOfPrincipals 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa-ldap-delegation-targets 2024-12-04T14:26:00Z DEBUG memberPrincipal: 2024-12-04T14:26:00Z DEBUG ldap/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/30-s4u2proxy.update 0.259 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/37-locations.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=locations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=locations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG locations 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Add IPA Locations";allow (add) groupdn = "ldap:///cn=System: Add IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "description")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Modify IPA Locations";allow (write) groupdn = "ldap:///cn=System: Modify IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || description || entryusn || idnsname || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Read IPA Locations";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Remove IPA Locations";allow (delete) groupdn = "ldap:///cn=System: Remove IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=locations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG locations 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Add IPA Locations";allow (add) groupdn = "ldap:///cn=System: Add IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "description")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Modify IPA Locations";allow (write) groupdn = "ldap:///cn=System: Modify IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || description || entryusn || idnsname || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Read IPA Locations";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Remove IPA Locations";allow (delete) groupdn = "ldap:///cn=System: Remove IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/37-locations.update 0.003 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/40-automember.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG automemberprocessmodifyops: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Auto Membership Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:26:00Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG Auto Membership plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG Auto Membership 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG automember_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libautomember-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpreoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG addifnew: 'cn=automember,cn=etc,dc=freeipa,dc=testdomain' to nsslapd-pluginConfigArea, current value ['cn=automember,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Auto Membership Plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG automemberprocessmodifyops: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Auto Membership Plugin 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:00Z DEBUG database 2024-12-04T14:26:00Z DEBUG nsslapd-pluginConfigArea: 2024-12-04T14:26:00Z DEBUG cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:00Z DEBUG Auto Membership plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:00Z DEBUG Auto Membership 2024-12-04T14:26:00Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:00Z DEBUG automember_init 2024-12-04T14:26:00Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:00Z DEBUG libautomember-plugin 2024-12-04T14:26:00Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:00Z DEBUG betxnpreoperation 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:00Z DEBUG 389 Project 2024-12-04T14:26:00Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:00Z DEBUG 2.4.6 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsSlapdPlugin 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG automember 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "automemberdefaultgroup || automemberdisabled || automemberfilter || automembergroupingattr || automemberscope || cn || createtimestamp || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=automemberdefinition)")(version 3.0;acl "permission:System: Read Automember Definitions";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "automemberexclusiveregex || automemberinclusiveregex || automembertargetgroup || cn || createtimestamp || description || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=automemberregexrule)")(version 3.0;acl "permission:System: Read Automember Rules";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG automember 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "automemberdefaultgroup || automemberdisabled || automemberfilter || automembergroupingattr || automemberscope || cn || createtimestamp || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=automemberdefinition)")(version 3.0;acl "permission:System: Read Automember Definitions";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "automemberexclusiveregex || automemberinclusiveregex || automembertargetgroup || cn || createtimestamp || description || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=automemberregexrule)")(version 3.0;acl "permission:System: Read Automember Rules";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Hostgroup,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Hostgroup,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG autoMemberDefinition 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Hostgroup 2024-12-04T14:26:00Z DEBUG autoMemberScope: 2024-12-04T14:26:00Z DEBUG cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG autoMemberFilter: 2024-12-04T14:26:00Z DEBUG objectclass=ipaHost 2024-12-04T14:26:00Z DEBUG autoMemberGroupingAttr: 2024-12-04T14:26:00Z DEBUG member:dn 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Hostgroup,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG autoMemberDefinition 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Hostgroup 2024-12-04T14:26:00Z DEBUG autoMemberScope: 2024-12-04T14:26:00Z DEBUG cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG autoMemberFilter: 2024-12-04T14:26:00Z DEBUG objectclass=ipaHost 2024-12-04T14:26:00Z DEBUG autoMemberGroupingAttr: 2024-12-04T14:26:00Z DEBUG member:dn 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Group,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Group,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG autoMemberDefinition 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Group 2024-12-04T14:26:00Z DEBUG autoMemberScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG autoMemberFilter: 2024-12-04T14:26:00Z DEBUG objectclass=posixAccount 2024-12-04T14:26:00Z DEBUG autoMemberGroupingAttr: 2024-12-04T14:26:00Z DEBUG member:dn 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Group,cn=automember,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG autoMemberDefinition 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Group 2024-12-04T14:26:00Z DEBUG autoMemberScope: 2024-12-04T14:26:00Z DEBUG cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG autoMemberFilter: 2024-12-04T14:26:00Z DEBUG objectclass=posixAccount 2024-12-04T14:26:00Z DEBUG autoMemberGroupingAttr: 2024-12-04T14:26:00Z DEBUG member:dn 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-automember.update 0.507 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/40-certprofile.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ca 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ca 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=certprofiles,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=certprofiles,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certprofiles 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Delete Certificate Profile";allow (delete) groupdn = "ldap:///cn=System: Delete Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Import Certificate Profile";allow (add) groupdn = "ldap:///cn=System: Import Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipacertprofilestoreissued")(targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Modify Certificate Profile";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipacertprofilestoreissued || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Read Certificate Profiles";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=certprofiles,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certprofiles 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Delete Certificate Profile";allow (delete) groupdn = "ldap:///cn=System: Delete Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Import Certificate Profile";allow (add) groupdn = "ldap:///cn=System: Import Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipacertprofilestoreissued")(targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Modify Certificate Profile";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipacertprofilestoreissued || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Read Certificate Profiles";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-certprofile.update 0.004 sec 2024-12-04T14:26:00Z DEBUG Parsing update file '/usr/share/ipa/updates/40-delegation.update' 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Write IPA Configuration 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG add: '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG HBAC Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG HBAC Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG HBAC Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG HBAC Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Sudo Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Sudo Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Sudo Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Sudo Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Password Policy Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Password Policy Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Password Policy Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Password Policy Administrator 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Host Enrollment 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Host Enrollment 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG add: 'cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain', 'cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Host Enrollment 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Host Enrollment 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:00Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG SELinux User Map Administrators 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG SELinux User Map Administrators 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG SELinux User Map Administrators 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG SELinux User Map Administrators 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Add SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Modify SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Retrieve Certificates from the CA 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG add: 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain' to member, current value ['cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain', 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain', 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Retrieve Certificates from the CA 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Revoke Certificate 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG add: 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain' to member, current value ['cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain', 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG add: updated value ['cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain', 'cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Revoke Certificate 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG ipa 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(|(objectClass=ipaConfigObject)(dnahostname=*))")(version 3.0;acl "Admins can change GUI config"; allow (delete) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create own Custodia secrets"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage own Custodia secrets"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "IPA server hosts can create Dogtag Custodia secrets for same host"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*/($dn),cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey")(version 3.0; acl "IPA server hosts can manage Dogtag Custodia secrets for same host"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain" and userdn = "ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "ipaPublicKey || ipaKeyUsage || memberPrincipal")(version 3.0; acl "Dogtag service principals can search Custodia keys"; allow(read, search, compare) userdn = "ldap:///krbprincipalname=dogtag/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(version 3.0; acl "Add CA Certificates for renewals"; allow(add) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "userCertificate")(version 3.0; acl "Modify CA Certificates for renewals"; allow(write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr = "cACertificate")(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificates 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG remove: '(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG remove: '(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=certificates,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificates 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Automember Task Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Automember Task Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Automember Task Administrator 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Automember Task Administrator 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Automember Task Administrator 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Automember Tasks,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Add Automember Rebuild Membership Task 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Automember Task Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG ipaPermissionType: 2024-12-04T14:26:00Z DEBUG SYSTEM 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Add Automember Rebuild Membership Task 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Automember Task Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG ipaPermissionType: 2024-12-04T14:26:00Z DEBUG SYSTEM 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG config 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG nsslapdConfig 2024-12-04T14:26:00Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:00Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-betype: 2024-12-04T14:26:00Z DEBUG ldbm database 2024-12-04T14:26:00Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:00Z DEBUG cn=schema 2024-12-04T14:26:00Z DEBUG cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-plugin: 2024-12-04T14:26:00Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 10 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:00Z DEBUG 16384 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-port: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-localuser: 2024-12-04T14:26:00Z DEBUG dirsrv 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG passwordInHistory: 2024-12-04T14:26:00Z DEBUG 6 2024-12-04T14:26:00Z DEBUG passwordUnlock: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordGraceLimit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG passwordMustChange: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:00Z DEBUG 100000 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG passwordWarning: 2024-12-04T14:26:00Z DEBUG 86400 2024-12-04T14:26:00Z DEBUG nsslapd-readonly: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:00Z DEBUG 16 2024-12-04T14:26:00Z DEBUG passwordLockout: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-localhost: 2024-12-04T14:26:00Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:00Z DEBUG 10000 2024-12-04T14:26:00Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG passwordMinLength: 2024-12-04T14:26:00Z DEBUG 8 2024-12-04T14:26:00Z DEBUG passwordMinDigits: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinAlphas: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinUppers: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinLowers: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinSpecials: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMin8bit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinCategories: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG passwordPalindrome: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordDictCheck: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordDictPath: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordUserAttributes: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordBadWords: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordMaxSequence: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:00Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:00Z DEBUG replication-only 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 500 2024-12-04T14:26:00Z DEBUG passwordMaxFailure: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:00Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-security: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordMaxAge: 2024-12-04T14:26:00Z DEBUG 8640000 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:00Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:00Z DEBUG passwordChange: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:00Z DEBUG 256 2024-12-04T14:26:00Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:00Z DEBUG 256 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-securePort: 2024-12-04T14:26:00Z DEBUG 636 2024-12-04T14:26:00Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:00Z DEBUG 223 2024-12-04T14:26:00Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordExp: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG day 2024-12-04T14:26:00Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-nagle: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:00Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:00Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:00Z DEBUG cn=Directory Manager 2024-12-04T14:26:00Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:00Z DEBUG uidNumber 2024-12-04T14:26:00Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:00Z DEBUG gidNumber 2024-12-04T14:26:00Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:00Z DEBUG dc=example,dc=com 2024-12-04T14:26:00Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:00Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:00Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-counters: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:00Z DEBUG cn=Directory Manager 2024-12-04T14:26:00Z DEBUG passwordMinAge: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:00Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:00Z DEBUG 209715200 2024-12-04T14:26:00Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:00Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:00Z DEBUG 524288 2024-12-04T14:26:00Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:00Z DEBUG allowed 2024-12-04T14:26:00Z DEBUG nsslapd-config: 2024-12-04T14:26:00Z DEBUG cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:00Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:00Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:00Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:00Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:00Z DEBUG /tmp 2024-12-04T14:26:00Z DEBUG nsslapd-certdir: 2024-12-04T14:26:00Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:00Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:00Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:00Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:00Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-rundir: 2024-12-04T14:26:00Z DEBUG /run/dirsrv 2024-12-04T14:26:00Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:00Z DEBUG 300000 2024-12-04T14:26:00Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-localssf: 2024-12-04T14:26:00Z DEBUG 71 2024-12-04T14:26:00Z DEBUG nsslapd-minssf: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:00Z DEBUG next 2024-12-04T14:26:00Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:00Z DEBUG warn 2024-12-04T14:26:00Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:00Z DEBUG 60 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:00Z DEBUG 20971520 2024-12-04T14:26:00Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:00Z DEBUG nolog 2024-12-04T14:26:00Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:00Z DEBUG 128 2024-12-04T14:26:00Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 500 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 10 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:00Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:00Z DEBUG dirsrv-log 2024-12-04T14:26:00Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:00Z DEBUG none 2024-12-04T14:26:00Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:00Z DEBUG process-safe 2024-12-04T14:26:00Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:00Z DEBUG 30 2024-12-04T14:26:00Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:00Z DEBUG 300 2024-12-04T14:26:00Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:00Z DEBUG 300 2024-12-04T14:26:00Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordStorageScheme: 2024-12-04T14:26:00Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:00Z DEBUG passwordAdminDN: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:00Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:00Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr=*)(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:00Z DEBUG remove: '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr=*)(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:00Z DEBUG add: '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=config 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG config 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG extensibleObject 2024-12-04T14:26:00Z DEBUG nsslapdConfig 2024-12-04T14:26:00Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:00Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-betype: 2024-12-04T14:26:00Z DEBUG ldbm database 2024-12-04T14:26:00Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:00Z DEBUG cn=schema 2024-12-04T14:26:00Z DEBUG cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-plugin: 2024-12-04T14:26:00Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:00Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:00Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:00Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 10 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:00Z DEBUG 16384 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-port: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-localuser: 2024-12-04T14:26:00Z DEBUG dirsrv 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG passwordInHistory: 2024-12-04T14:26:00Z DEBUG 6 2024-12-04T14:26:00Z DEBUG passwordUnlock: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordGraceLimit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG passwordMustChange: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:00Z DEBUG 100000 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG passwordWarning: 2024-12-04T14:26:00Z DEBUG 86400 2024-12-04T14:26:00Z DEBUG nsslapd-readonly: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:00Z DEBUG 16 2024-12-04T14:26:00Z DEBUG passwordLockout: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-localhost: 2024-12-04T14:26:00Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:00Z DEBUG 10000 2024-12-04T14:26:00Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:00Z DEBUG 40 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG passwordMinLength: 2024-12-04T14:26:00Z DEBUG 8 2024-12-04T14:26:00Z DEBUG passwordMinDigits: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinAlphas: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinUppers: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinLowers: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinSpecials: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMin8bit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMinCategories: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG passwordPalindrome: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordDictCheck: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordDictPath: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordUserAttributes: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordBadWords: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordMaxSequence: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:00Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:00Z DEBUG replication-only 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 500 2024-12-04T14:26:00Z DEBUG passwordMaxFailure: 2024-12-04T14:26:00Z DEBUG 3 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:00Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-security: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordMaxAge: 2024-12-04T14:26:00Z DEBUG 8640000 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:00Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:00Z DEBUG passwordChange: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:00Z DEBUG 256 2024-12-04T14:26:00Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:00Z DEBUG 256 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-securePort: 2024-12-04T14:26:00Z DEBUG 636 2024-12-04T14:26:00Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:00Z DEBUG 223 2024-12-04T14:26:00Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG passwordExp: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG day 2024-12-04T14:26:00Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-nagle: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:00Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:00Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:00Z DEBUG cn=Directory Manager 2024-12-04T14:26:00Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:00Z DEBUG uidNumber 2024-12-04T14:26:00Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:00Z DEBUG gidNumber 2024-12-04T14:26:00Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:00Z DEBUG dc=example,dc=com 2024-12-04T14:26:00Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:00Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:00Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-counters: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:00Z DEBUG cn=Directory Manager 2024-12-04T14:26:00Z DEBUG passwordMinAge: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:00Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:00Z DEBUG 209715200 2024-12-04T14:26:00Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:00Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:00Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:00Z DEBUG 524288 2024-12-04T14:26:00Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:00Z DEBUG allowed 2024-12-04T14:26:00Z DEBUG nsslapd-config: 2024-12-04T14:26:00Z DEBUG cn=config 2024-12-04T14:26:00Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:00Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:00Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:00Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:00Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:00Z DEBUG /tmp 2024-12-04T14:26:00Z DEBUG nsslapd-certdir: 2024-12-04T14:26:00Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:00Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:00Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:00Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:00Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:00Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-rundir: 2024-12-04T14:26:00Z DEBUG /run/dirsrv 2024-12-04T14:26:00Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:00Z DEBUG 300000 2024-12-04T14:26:00Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-localssf: 2024-12-04T14:26:00Z DEBUG 71 2024-12-04T14:26:00Z DEBUG nsslapd-minssf: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:00Z DEBUG next 2024-12-04T14:26:00Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:00Z DEBUG warn 2024-12-04T14:26:00Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:00Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:00Z DEBUG 60 2024-12-04T14:26:00Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:00Z DEBUG 20971520 2024-12-04T14:26:00Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:00Z DEBUG nolog 2024-12-04T14:26:00Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:00Z DEBUG 2097152 2024-12-04T14:26:00Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:00Z DEBUG 128 2024-12-04T14:26:00Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:00Z DEBUG -10 2024-12-04T14:26:00Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:00Z DEBUG -1 2024-12-04T14:26:00Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 2 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:00Z DEBUG 600 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:00Z DEBUG 0 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:00Z DEBUG 500 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:00Z DEBUG 100 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:00Z DEBUG 1 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:00Z DEBUG 10 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:00Z DEBUG month 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:00Z DEBUG 5 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:00Z DEBUG week 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:00Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:00Z DEBUG dirsrv-log 2024-12-04T14:26:00Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:00Z DEBUG none 2024-12-04T14:26:00Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:00Z DEBUG process-safe 2024-12-04T14:26:00Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:00Z DEBUG 3600 2024-12-04T14:26:00Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:00Z DEBUG 30 2024-12-04T14:26:00Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:00Z DEBUG 300 2024-12-04T14:26:00Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:00Z DEBUG 300 2024-12-04T14:26:00Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG passwordStorageScheme: 2024-12-04T14:26:00Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:00Z DEBUG passwordAdminDN: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:00Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:00Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:00Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:00Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:00Z DEBUG on 2024-12-04T14:26:00Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:00Z DEBUG off 2024-12-04T14:26:00Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:00Z DEBUG 2024-12-04T14:26:00Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:00Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG retrieve certificate 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG retrieve certificate 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate different host 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate different host 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificate status 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificate status 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG revoke certificate 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG revoke certificate 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificate remove hold 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG certificate remove hold 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate ignore caacl 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG nsContainer 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG request certificate ignore caacl 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Request Certificate ignoring CA ACLs 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG ipapermission 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG Request Certificate ignoring CA ACLs 2024-12-04T14:26:00Z DEBUG member: 2024-12-04T14:26:00Z DEBUG cn=Certificate Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG add: '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:00Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG domain 2024-12-04T14:26:00Z DEBUG pilotObject 2024-12-04T14:26:00Z DEBUG domainRelatedObject 2024-12-04T14:26:00Z DEBUG nisDomainObject 2024-12-04T14:26:00Z DEBUG dc: 2024-12-04T14:26:00Z DEBUG freeipa 2024-12-04T14:26:00Z DEBUG info: 2024-12-04T14:26:00Z DEBUG IPA V2.0 2024-12-04T14:26:00Z DEBUG nisDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG associatedDomain: 2024-12-04T14:26:00Z DEBUG freeipa.testdomain 2024-12-04T14:26:00Z DEBUG aci: 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:00Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:00Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:00Z DEBUG [] 2024-12-04T14:26:00Z DEBUG Updated 0 2024-12-04T14:26:00Z DEBUG Done 2024-12-04T14:26:00Z DEBUG Updating existing entry: cn=RBAC Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Initial value 2024-12-04T14:26:00Z DEBUG dn: cn=RBAC Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG RBAC Readers 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Read roles, privileges, permissions and ACIs 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG --------------------------------------------- 2024-12-04T14:26:00Z DEBUG Final value after applying updates 2024-12-04T14:26:00Z DEBUG dn: cn=RBAC Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG objectClass: 2024-12-04T14:26:00Z DEBUG nestedgroup 2024-12-04T14:26:00Z DEBUG groupofnames 2024-12-04T14:26:00Z DEBUG top 2024-12-04T14:26:00Z DEBUG cn: 2024-12-04T14:26:00Z DEBUG RBAC Readers 2024-12-04T14:26:00Z DEBUG description: 2024-12-04T14:26:00Z DEBUG Read roles, privileges, permissions and ACIs 2024-12-04T14:26:00Z DEBUG memberOf: 2024-12-04T14:26:00Z DEBUG cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:00Z DEBUG cn=System: Read Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Password Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Password Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Password Policy Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read password policies 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Password Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Password Policy Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read password policies 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Kerberos Ticket Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Kerberos Ticket Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Kerberos Ticket Policy Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read global and per-user Kerberos ticket policy 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Kerberos Ticket Policy Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Kerberos Ticket Policy Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read global and per-user Kerberos ticket policy 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Automember Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Automember Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Automember Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read Automember definitions 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Automember Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Automember Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read Automember definitions 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read Automember Definitions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Automember Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=IPA Masters Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=IPA Masters Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA Masters Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read list of IPA masters 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=IPA Masters Readers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA Masters Readers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Read list of IPA masters 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG masters 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) userdn = "ldap:///fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG masters 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=PassSync Service,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=PassSync Service,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG PassSync Service 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG PassSync Service 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=PassSync Service,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG PassSync Service 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG PassSync Service 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read PassSync Managers Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read PassSync Managers Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read Replication Changelog Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read Replication Changelog Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Write Replication Changelog Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Write Replication Changelog Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Modify PassSync Managers Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Modify PassSync Managers Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read LDBM Database Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read LDBM Database Configuration 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Add Configuration Sub-Entries 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Add Configuration Sub-Entries 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG add: '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)', '(target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)', '(version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG config 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsslapdConfig 2024-12-04T14:26:01Z DEBUG nsslapd-backendconfig: 2024-12-04T14:26:01Z DEBUG cn=config,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=ipaca,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=config,cn=changelog,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-betype: 2024-12-04T14:26:01Z DEBUG ldbm database 2024-12-04T14:26:01Z DEBUG nsslapd-privatenamespaces: 2024-12-04T14:26:01Z DEBUG cn=schema 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-plugin: 2024-12-04T14:26:01Z DEBUG cn=binary syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bit string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=boolean syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case exact string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=case ignore string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=country string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=delivery method syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguished name syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=enhanced guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=entryuuid_syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=facsimile telephone number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=fax syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalized time syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=guide syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=in chain,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integer syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=jpeg syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=name and optional uid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numeric string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octet string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=oid syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=postal address syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=printable string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=space insensitive string syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephone syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=teletex terminal identifier syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telex number syntax,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=octetstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=bitwise plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseexactia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=generalizedtimeorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=booleanmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5match,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreia5substringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoreorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignoresubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=caseignorelistsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifiermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=directorystringfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=objectidentifierfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=distinguishednamematch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uuidorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=inchainmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=integerfirstcomponentmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=internationalization plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=uniquemembermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringorderingmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=numericstringsubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbermatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn=telephonenumbersubstringsmatch,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-requiresrestart: 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-port 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-secureport 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapifilepath 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-ldapilisten 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-workingdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-sslclientauth 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogdir 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogsuffix 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxentries 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-changelogmaxage 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-db-locks 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-maxdescriptors 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-numlisteners 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-return-exact-case 2024-12-04T14:26:01Z DEBUG cn=config:nsslapd-schema-ignore-trailing-spaces 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-idlistscanlimit 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-parentcheck 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbcachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-dbncache 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-cachesize 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-plugin 2024-12-04T14:26:01Z DEBUG cn=config,cn=ldbm:nsslapd-backend-implement 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslsessiontimeout 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nssslclientauth 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl2 2024-12-04T14:26:01Z DEBUG cn=encryption,cn=config:nsssl3 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-level: 2024-12-04T14:26:01Z DEBUG 16384 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-compress: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-compress: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-port: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-workingdir: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-maxthreadsperconn: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-localuser: 2024-12-04T14:26:01Z DEBUG dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordInHistory: 2024-12-04T14:26:01Z DEBUG 6 2024-12-04T14:26:01Z DEBUG passwordUnlock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordGraceLimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordAdminSkipInfoUpdate: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG passwordMustChange: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-local: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-pwpolicy-inherit-global: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-sizelimit: 2024-12-04T14:26:01Z DEBUG 100000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordWarning: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-mapping-fallback: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-threadnumber: 2024-12-04T14:26:01Z DEBUG 16 2024-12-04T14:26:01Z DEBUG passwordLockout: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enquote-sup-oc: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-localhost: 2024-12-04T14:26:01Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-ioblocktimeout: 2024-12-04T14:26:01Z DEBUG 10000 2024-12-04T14:26:01Z DEBUG nsslapd-max-filter-nest-level: 2024-12-04T14:26:01Z DEBUG 40 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG passwordMinLength: 2024-12-04T14:26:01Z DEBUG 8 2024-12-04T14:26:01Z DEBUG passwordMinDigits: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinAlphas: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinUppers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinLowers: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinSpecials: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMin8bit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxRepeats: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMinCategories: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordMinTokenLength: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG passwordPalindrome: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictCheck: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordDictPath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordUserAttributes: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordBadWords: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordMaxSequence: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxSeqSets: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG passwordMaxClassChars: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/errors 2024-12-04T14:26:01Z DEBUG nsslapd-external-libs-debug-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-schemacheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-schemamod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxcheck: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-syntaxlogging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dn-validate-strict: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ds4-compatible-schema: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schema-ignore-trailing-spaces: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-schemareplace: 2024-12-04T14:26:01Z DEBUG replication-only 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG passwordMaxFailure: 2024-12-04T14:26:01Z DEBUG 3 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access 2024-12-04T14:26:01Z DEBUG nsslapd-lastmod: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-security: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordMaxAge: 2024-12-04T14:26:01Z DEBUG 8640000 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG passwordResetFailureCount: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG passwordTPRMaxUse: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayExpireAt: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordTPRDelayValidFrom: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG passwordIsGlobalPolicy: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordLegacyPolicy: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordTrackUpdateTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-groupevalnestlevel: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-rootpw: 2024-12-04T14:26:01Z DEBUG {PBKDF2-SHA512}10000$kxn/4Rku2fex9u8sCc+yAPomT2ZiA6yp$D13grUoZWyKRhPoCy47m4oXJsax1nVaHLOjDgst1Kg2P2bPU5d/ncCFNYam4RGfk+ZYq+mIatYFo4LC+gPBDUw== 2024-12-04T14:26:01Z DEBUG passwordChange: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-statlog-level: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-level: 2024-12-04T14:26:01Z DEBUG 256 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securePort: 2024-12-04T14:26:01Z DEBUG 636 2024-12-04T14:26:01Z DEBUG nsslapd-certmap-basedn: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-timelimit: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-reservedescriptors: 2024-12-04T14:26:01Z DEBUG 223 2024-12-04T14:26:01Z DEBUG nsslapd-svrtab: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG passwordExp: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG passwordSendExpiringTime: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-accesscontrol: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG day 2024-12-04T14:26:01Z DEBUG passwordLockoutDuration: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-idletimeout: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-nagle: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-display-attrs: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logbuffering: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-csnlogging: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-allow-hashed-passwords: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordCheckSyntax: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-snmp-index: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-ldapifilepath: 2024-12-04T14:26:01Z DEBUG /run/slapd-FREEIPA-TESTDOMAIN.socket 2024-12-04T14:26:01Z DEBUG nsslapd-ldapilisten: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiautobind: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaprootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG nsslapd-ldapimaptoentries: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapiuidnumbertype: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapigidnumbertype: 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG nsslapd-ldapientrysearchbase: 2024-12-04T14:26:01Z DEBUG dc=example,dc=com 2024-12-04T14:26:01Z DEBUG nsslapd-ldapidnmappingbase: 2024-12-04T14:26:01Z DEBUG cn=auto_bind,cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-anonlimitsdn: 2024-12-04T14:26:01Z DEBUG cn=anonymous-limits,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-counters: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-securelistenhost: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-rootdn: 2024-12-04T14:26:01Z DEBUG cn=Directory Manager 2024-12-04T14:26:01Z DEBUG passwordMinAge: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-return-exact-case: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-result-tweak: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-binddn-tracking: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-moddn-aci: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-targetfilter-cache: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-attribute-name-exceptions: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-maxbersize: 2024-12-04T14:26:01Z DEBUG 209715200 2024-12-04T14:26:01Z DEBUG nsslapd-maxsasliosize: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-versionstring: 2024-12-04T14:26:01Z DEBUG 389-Directory/2.4.6 2024-12-04T14:26:01Z DEBUG nsslapd-referralmode: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-numlisteners: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-maxdescriptors: 2024-12-04T14:26:01Z DEBUG 524288 2024-12-04T14:26:01Z DEBUG nsslapd-SSLclientAuth: 2024-12-04T14:26:01Z DEBUG allowed 2024-12-04T14:26:01Z DEBUG nsslapd-config: 2024-12-04T14:26:01Z DEBUG cn=config 2024-12-04T14:26:01Z DEBUG nsslapd-instancedir: 2024-12-04T14:26:01Z DEBUG /usr/lib64/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-schemadir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN/schema 2024-12-04T14:26:01Z DEBUG nsslapd-lockdir: 2024-12-04T14:26:01Z DEBUG /run/lock/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-tmpdir: 2024-12-04T14:26:01Z DEBUG /tmp 2024-12-04T14:26:01Z DEBUG nsslapd-certdir: 2024-12-04T14:26:01Z DEBUG /etc/dirsrv/slapd-FREEIPA-TESTDOMAIN 2024-12-04T14:26:01Z DEBUG nsslapd-ldifdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/ldif 2024-12-04T14:26:01Z DEBUG nsslapd-bakdir: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/bak 2024-12-04T14:26:01Z DEBUG nsslapd-saslpath: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rundir: 2024-12-04T14:26:01Z DEBUG /run/dirsrv 2024-12-04T14:26:01Z DEBUG nsslapd-rewrite-rfc1274: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-outbound-ldap-io-timeout: 2024-12-04T14:26:01Z DEBUG 300000 2024-12-04T14:26:01Z DEBUG nsslapd-allow-unauthenticated-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-secure-binds: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-close-on-failed-bind: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-allow-anonymous-access: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-localssf: 2024-12-04T14:26:01Z DEBUG 71 2024-12-04T14:26:01Z DEBUG nsslapd-minssf: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-minssf-exclude-rootdse: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-force-sasl-external: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-global: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-entryusn-import-initval: 2024-12-04T14:26:01Z DEBUG next 2024-12-04T14:26:01Z DEBUG nsslapd-validate-cert: 2024-12-04T14:26:01Z DEBUG warn 2024-12-04T14:26:01Z DEBUG nsslapd-pagedsizelimit: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-defaultnamingcontext: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-readonly-on-threshold: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-threshold: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-grace-period: 2024-12-04T14:26:01Z DEBUG 60 2024-12-04T14:26:01Z DEBUG nsslapd-disk-monitoring-logging-critical: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ndn-cache-max-size: 2024-12-04T14:26:01Z DEBUG 20971520 2024-12-04T14:26:01Z DEBUG nsslapd-allowed-sasl-mechanisms: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-virtual-attrs: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-unhashed-pw-switch: 2024-12-04T14:26:01Z DEBUG nolog 2024-12-04T14:26:01Z DEBUG nsslapd-sasl-max-buffer-size: 2024-12-04T14:26:01Z DEBUG 2097152 2024-12-04T14:26:01Z DEBUG nsslapd-search-return-original-type-switch: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-enable-turbo-mode: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-connection-buffer: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-connection-nocanon: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-logging: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-listen-backlog-size: 2024-12-04T14:26:01Z DEBUG 128 2024-12-04T14:26:01Z DEBUG nsslapd-dynamic-plugins: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-cn-uses-dn-syntax-in-dns: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mxfast: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-trim-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-malloc-mmap-threshold: 2024-12-04T14:26:01Z DEBUG -10 2024-12-04T14:26:01Z DEBUG nsslapd-ignore-time-skew: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-global-backend-lock: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-maxsimplepaged-per-conn: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-enable-nunc-stans: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logging-hide-unhashed-pw: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/audit 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-mode: 2024-12-04T14:26:01Z DEBUG 600 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsync-enabled: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsynchour: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationsyncmin: 2024-12-04T14:26:01Z DEBUG 0 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logmaxdiskspace: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsize: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtime: 2024-12-04T14:26:01Z DEBUG 1 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-maxlogsperdir: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logging-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logexpirationtimeunit: 2024-12-04T14:26:01Z DEBUG month 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logminfreediskspace: 2024-12-04T14:26:01Z DEBUG 5 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-logrotationtimeunit: 2024-12-04T14:26:01Z DEBUG week 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/security 2024-12-04T14:26:01Z DEBUG nsslapd-logging-hr-timestamps-enabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-extract-pemfiles: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-logging-backend: 2024-12-04T14:26:01Z DEBUG dirsrv-log 2024-12-04T14:26:01Z DEBUG nsslapd-tls-check-crl: 2024-12-04T14:26:01Z DEBUG none 2024-12-04T14:26:01Z DEBUG nsslapd-enable-upgrade-hash: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-verify-filter-schema: 2024-12-04T14:26:01Z DEBUG process-safe 2024-12-04T14:26:01Z DEBUG nsslapd-enable-ldapssotoken: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-ttl-secs: 2024-12-04T14:26:01Z DEBUG 3600 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-fin-timeout: 2024-12-04T14:26:01Z DEBUG 30 2024-12-04T14:26:01Z DEBUG nsslapd-tcp-keepalive-time: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-referral-check-period: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG nsslapd-return-original-entrydn: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG passwordStorageScheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG passwordAdminDN: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-rootpwstoragescheme: 2024-12-04T14:26:01Z DEBUG PBKDF2-SHA512 2024-12-04T14:26:01Z DEBUG nsslapd-errorlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-accesslog-list: 2024-12-04T14:26:01Z DEBUG /var/log/dirsrv/slapd-FREEIPA-TESTDOMAIN/access.20241128-160450 2024-12-04T14:26:01Z DEBUG nsslapd-auditlog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ssl-check-hostname: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-hash-filters: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-auditfaillog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-securitylog-list: 2024-12-04T14:26:01Z DEBUG 2024-12-04T14:26:01Z DEBUG nsslapd-ldapssotoken-secret: 2024-12-04T14:26:01Z DEBUG NQ2mV_Q11MfF5k-y-2eIP7N2WWN4K6UIGJE24UhY_F0= 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr = "*")(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || objectclass || passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Read PassSync Managers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || objectclass || nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Read Replication Changelog Configuration"; allow (read,search) groupdn = "ldap:///cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-changelogmaxentries || nsslapd-changelogmaxage || nsslapd-changelogtrim-interval || nsslapd-encryptionalgorithm || nsSymmetricKey")(targetfilter = "cn=changelog")(target = "ldap:///cn=ldbm database,cn=plugins,cn=config")(version 3.0; acl "permission:Write Replication Changelog Configuration"; allow (write) groupdn = "ldap:///cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "passsyncmanagersdns*")(target = "ldap:///cn=ipa_pwd_extop,cn=plugins,cn=config")(version 3.0;acl "permission:Modify PassSync Managers Configuration";allow (write) groupdn = "ldap:///cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || modifytimestamp || nsslapd-directory* || objectclass")(target = "ldap:///cn=config,cn=ldbm database,cn=plugins,cn=config")(version 3.0;acl "permission:Read LDBM Database Configuration";allow (compare,read,search) groupdn = "ldap:///cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";) 2024-12-04T14:26:01Z DEBUG (version 3.0;acl "permission:Add Configuration Sub-Entries";allow (add) groupdn = "ldap:///cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=CA Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=CA Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG CA Administrator 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG CA Administrator 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage CA ACL Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Import Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=CA Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG CA Administrator 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG CA Administrator 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage CA ACL Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Import Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Certificate Profile,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Vault Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Vault Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Vault Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Vault Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Vault Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Vault Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG Vault Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=DNS Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=DNS Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG DNS Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG DNS Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=DNS Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG DNS Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG DNS Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove IPA Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=DNS Servers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=DNS Servers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG DNS Servers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG DNS Servers 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG krbprincipalname=DNS/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG krbprincipalname=ipa-dnskeysyncd/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=DNS Servers,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG DNS Servers 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG DNS Servers 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG krbprincipalname=DNS/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG krbprincipalname=ipa-dnskeysyncd/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=External IdP server Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG External IdP server Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG External IdP server Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG nestedgroup 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG External IdP server Administrators 2024-12-04T14:26:01Z DEBUG description: 2024-12-04T14:26:01Z DEBUG External IdP server Administrators 2024-12-04T14:26:01Z DEBUG memberOf: 2024-12-04T14:26:01Z DEBUG cn=System: Add External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Delete External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Modify External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG cn=System: Read External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-delegation.update 1.007 sec 2024-12-04T14:26:01Z DEBUG Parsing update file '/usr/share/ipa/updates/40-dns.update' 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG addifexist: 'idnsConfigObject' to objectClass, current value ['idnsConfigObject', 'nsContainer', 'ipaConfigObject', 'ipaDNSContainer', 'top'] 2024-12-04T14:26:01Z DEBUG addifexist: set objectClass to ['idnsConfigObject', 'nsContainer', 'ipaConfigObject', 'ipaDNSContainer', 'top', 'idnsConfigObject'] 2024-12-04T14:26:01Z DEBUG addifexist: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG addifexist: set aci to ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: set aci to ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: set aci to ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)'] 2024-12-04T14:26:01Z DEBUG addifexist: set aci to ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG replace: (targetattr = "*")(version 3.0; acl "No access to DNS tree without a permission"; deny (read,search,compare) (groupdn != "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain") and (groupdn != "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain");) not found, skipping 2024-12-04T14:26:01Z DEBUG replace: (targetattr = "*")(version 3.0; acl "Allow read access"; allow (read,search,compare) groupdn = "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain" or userattr = "parent[0,1].managedby#GROUPDN";) not found, skipping 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' from aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || dlvrecord || idnssecinlinesigning || nsec3paramrecord || tlsarecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' from aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || dlvrecord || idnssecinlinesigning || nsec3paramrecord || tlsarecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || dlvrecord || idnssecinlinesigning || nsec3paramrecord || tlsarecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' from aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || dlvrecord || idnssecinlinesigning || nsec3paramrecord || tlsarecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' from aci, current value ['(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)', '(targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)' not in aci 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=dns,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG idnsConfigObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG ipaConfigObject 2024-12-04T14:26:01Z DEBUG ipaDNSContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG dns 2024-12-04T14:26:01Z DEBUG ipaConfigString: 2024-12-04T14:26:01Z DEBUG DNSVersion 1 2024-12-04T14:26:01Z DEBUG ipaDNSVersion: 2024-12-04T14:26:01Z DEBUG 2 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Add DNS entries in a zone";allow (add) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Remove DNS entries from a zone";allow (delete) userattr = "parent[1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsec3paramrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || urirecord || unknownrecord ")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=*)(arecord=*)(cnamerecord=*)(ptrrecord=*)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=IPA DNS,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=IPA DNS,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA DNS 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG IPA DNS support plugin 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa_dns 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipadns_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_dns.so 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG Red Hat, Inc. 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG 1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsslapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=IPA DNS,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA DNS 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG IPA DNS support plugin 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa_dns 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipadns_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_dns.so 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG Red Hat, Inc. 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG 1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsslapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-dns.update 0.013 sec 2024-12-04T14:26:01Z DEBUG Parsing update file '/usr/share/ipa/updates/40-idp.update' 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=idp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=idp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG idp 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Add External IdP server";allow (add) groupdn = "ldap:///cn=System: Add External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Delete External IdP server";allow (delete) groupdn = "ldap:///cn=System: Delete External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Modify External IdP server";allow (write) groupdn = "ldap:///cn=System: Modify External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server client secret";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server client secret,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=idp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG idp 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Add External IdP server";allow (add) groupdn = "ldap:///cn=System: Add External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Delete External IdP server";allow (delete) groupdn = "ldap:///cn=System: Delete External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Modify External IdP server";allow (write) groupdn = "ldap:///cn=System: Modify External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server client secret";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server client secret,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=ipaidpconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=ipaidpconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG ipaidpconfiglink 2024-12-04T14:26:01Z DEBUG nsIndexType: 2024-12-04T14:26:01Z DEBUG eq 2024-12-04T14:26:01Z DEBUG pres 2024-12-04T14:26:01Z DEBUG sub 2024-12-04T14:26:01Z DEBUG nsSystemIndex: 2024-12-04T14:26:01Z DEBUG false 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsIndex 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG only: set cn to 'ipaidpconfiglink', current value ['ipaidpconfiglink'] 2024-12-04T14:26:01Z DEBUG only: updated value ['ipaidpconfiglink'] 2024-12-04T14:26:01Z DEBUG add: 'eq' to nsIndexType, current value ['eq', 'pres', 'sub'] 2024-12-04T14:26:01Z DEBUG add: updated value ['pres', 'sub', 'eq'] 2024-12-04T14:26:01Z DEBUG add: 'pres' to nsIndexType, current value ['pres', 'sub', 'eq'] 2024-12-04T14:26:01Z DEBUG add: updated value ['sub', 'eq', 'pres'] 2024-12-04T14:26:01Z DEBUG add: 'sub' to nsIndexType, current value ['sub', 'eq', 'pres'] 2024-12-04T14:26:01Z DEBUG add: updated value ['eq', 'pres', 'sub'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=ipaidpconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG ipaidpconfiglink 2024-12-04T14:26:01Z DEBUG nsIndexType: 2024-12-04T14:26:01Z DEBUG eq 2024-12-04T14:26:01Z DEBUG pres 2024-12-04T14:26:01Z DEBUG sub 2024-12-04T14:26:01Z DEBUG nsSystemIndex: 2024-12-04T14:26:01Z DEBUG false 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsIndex 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-idp.update 0.005 sec 2024-12-04T14:26:01Z DEBUG Parsing update file '/usr/share/ipa/updates/40-otp.update' 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=otp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=otp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG otp 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=otp,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG otp 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=otp,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=otp,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG ipatokenOTPConfig 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG otp 2024-12-04T14:26:01Z DEBUG ipatokenTOTPauthWindow: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG ipatokenTOTPsyncWindow: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG ipatokenHOTPauthWindow: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG ipatokenHOTPsyncWindow: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokentotpauthwindow || ipatokentotpsyncwindow")(targetfilter = "(objectclass=ipatokenotpconfig)")(version 3.0;acl "permission:System: Read OTP Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=otp,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG ipatokenOTPConfig 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG otp 2024-12-04T14:26:01Z DEBUG ipatokenTOTPauthWindow: 2024-12-04T14:26:01Z DEBUG 300 2024-12-04T14:26:01Z DEBUG ipatokenTOTPsyncWindow: 2024-12-04T14:26:01Z DEBUG 86400 2024-12-04T14:26:01Z DEBUG ipatokenHOTPauthWindow: 2024-12-04T14:26:01Z DEBUG 10 2024-12-04T14:26:01Z DEBUG ipatokenHOTPsyncWindow: 2024-12-04T14:26:01Z DEBUG 100 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokentotpauthwindow || ipatokentotpsyncwindow")(targetfilter = "(objectclass=ipatokenotpconfig)")(version 3.0;acl "permission:System: Read OTP Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG domain 2024-12-04T14:26:01Z DEBUG pilotObject 2024-12-04T14:26:01Z DEBUG domainRelatedObject 2024-12-04T14:26:01Z DEBUG nisDomainObject 2024-12-04T14:26:01Z DEBUG dc: 2024-12-04T14:26:01Z DEBUG freeipa 2024-12-04T14:26:01Z DEBUG info: 2024-12-04T14:26:01Z DEBUG IPA V2.0 2024-12-04T14:26:01Z DEBUG nisDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG associatedDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG remove: '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG remove: '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' not in aci 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' not in aci 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG domain 2024-12-04T14:26:01Z DEBUG pilotObject 2024-12-04T14:26:01Z DEBUG domainRelatedObject 2024-12-04T14:26:01Z DEBUG nisDomainObject 2024-12-04T14:26:01Z DEBUG dc: 2024-12-04T14:26:01Z DEBUG freeipa 2024-12-04T14:26:01Z DEBUG info: 2024-12-04T14:26:01Z DEBUG IPA V2.0 2024-12-04T14:26:01Z DEBUG nisDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG associatedDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:01Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:01Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=radiusproxy,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=radiusproxy,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG radiusproxy 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipatokenradiusretries || ipatokenradiusserver || ipatokenradiustimeout || ipatokenusermapattribute || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipatokenradiusconfiguration)")(version 3.0;acl "permission:System: Read Radius Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=radiusproxy,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG radiusproxy 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipatokenradiusretries || ipatokenradiusserver || ipatokenradiustimeout || ipatokenusermapattribute || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipatokenradiusconfiguration)")(version 3.0;acl "permission:System: Read Radius Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=IPA OTP Last Token,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=IPA OTP Last Token,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA OTP Last Token 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG Protect the user's last active token 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa-otp-lasttoken 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipa_otp_lasttoken_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_otp_lasttoken 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG FreeIPA 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG FreeIPA/1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsSlapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=IPA OTP Last Token,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA OTP Last Token 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG Protect the user's last active token 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa-otp-lasttoken 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipa_otp_lasttoken_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_otp_lasttoken 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG FreeIPA 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG FreeIPA/1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsSlapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=IPA OTP Counter,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=IPA OTP Counter,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA OTP Counter 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG Ensure proper OTP token counter operation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa-otp-counter 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipa_otp_counter_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_otp_counter 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG FreeIPA 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG FreeIPA/1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsSlapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=IPA OTP Counter,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG IPA OTP Counter 2024-12-04T14:26:01Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:01Z DEBUG database 2024-12-04T14:26:01Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:01Z DEBUG Ensure proper OTP token counter operation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:01Z DEBUG on 2024-12-04T14:26:01Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:01Z DEBUG ipa-otp-counter 2024-12-04T14:26:01Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:01Z DEBUG ipa_otp_counter_init 2024-12-04T14:26:01Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:01Z DEBUG libipa_otp_counter 2024-12-04T14:26:01Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:01Z DEBUG preoperation 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:01Z DEBUG FreeIPA 2024-12-04T14:26:01Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:01Z DEBUG FreeIPA/1.0 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG nsSlapdPlugin 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-otp.update 0.025 sec 2024-12-04T14:26:01Z DEBUG Parsing update file '/usr/share/ipa/updates/40-realm_domains.update' 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Realm Domains,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Realm Domains,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG domainRelatedObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Realm Domains 2024-12-04T14:26:01Z DEBUG associatedDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "associateddomain")(targetfilter = "(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Modify Realm Domains";allow (write) groupdn = "ldap:///cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "associateddomain || cn || createtimestamp || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Read Realm Domains";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Realm Domains,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG domainRelatedObject 2024-12-04T14:26:01Z DEBUG nsContainer 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Realm Domains 2024-12-04T14:26:01Z DEBUG associatedDomain: 2024-12-04T14:26:01Z DEBUG freeipa.testdomain 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "associateddomain")(targetfilter = "(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Modify Realm Domains";allow (write) groupdn = "ldap:///cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "associateddomain || cn || createtimestamp || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Read Realm Domains";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-realm_domains.update 0.003 sec 2024-12-04T14:26:01Z DEBUG Parsing update file '/usr/share/ipa/updates/40-replication.update' 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG userRoot 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsBackendInstance 2024-12-04T14:26:01Z DEBUG nsslapd-suffix: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-cachesize: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-cachememsize: 2024-12-04T14:26:01Z DEBUG 201326592 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-index: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-internalop-index: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dncachememsize: 2024-12-04T14:26:01Z DEBUG 67108864 2024-12-04T14:26:01Z DEBUG nsslapd-directory: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db/userRoot 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG userRoot 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG nsBackendInstance 2024-12-04T14:26:01Z DEBUG nsslapd-suffix: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG nsslapd-cachesize: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG nsslapd-cachememsize: 2024-12-04T14:26:01Z DEBUG 201326592 2024-12-04T14:26:01Z DEBUG nsslapd-readonly: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-index: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-require-internalop-index: 2024-12-04T14:26:01Z DEBUG off 2024-12-04T14:26:01Z DEBUG nsslapd-dncachememsize: 2024-12-04T14:26:01Z DEBUG 67108864 2024-12-04T14:26:01Z DEBUG nsslapd-directory: 2024-12-04T14:26:01Z DEBUG /var/lib/dirsrv/slapd-FREEIPA-TESTDOMAIN/db/userRoot 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "nsslapd-readonly")(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Modify DNA Range 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Modify DNA Range 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Posix IDs 2024-12-04T14:26:01Z DEBUG dnaExcludeScope: 2024-12-04T14:26:01Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaFilter: 2024-12-04T14:26:01Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:01Z DEBUG dnaMagicRegen: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG dnaMaxValue: 2024-12-04T14:26:01Z DEBUG 500000 2024-12-04T14:26:01Z DEBUG dnaNextValue: 2024-12-04T14:26:01Z DEBUG 60006 2024-12-04T14:26:01Z DEBUG dnaScope: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:01Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaThreshold: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG dnaType: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Posix IDs 2024-12-04T14:26:01Z DEBUG dnaExcludeScope: 2024-12-04T14:26:01Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaFilter: 2024-12-04T14:26:01Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:01Z DEBUG dnaMagicRegen: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG dnaMaxValue: 2024-12-04T14:26:01Z DEBUG 500000 2024-12-04T14:26:01Z DEBUG dnaNextValue: 2024-12-04T14:26:01Z DEBUG 60006 2024-12-04T14:26:01Z DEBUG dnaScope: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:01Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaThreshold: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG dnaType: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read DNA Range 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read DNA Range 2024-12-04T14:26:01Z DEBUG ipaPermissionType: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG Updating existing entry: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Posix IDs 2024-12-04T14:26:01Z DEBUG dnaExcludeScope: 2024-12-04T14:26:01Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaFilter: 2024-12-04T14:26:01Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:01Z DEBUG dnaMagicRegen: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG dnaMaxValue: 2024-12-04T14:26:01Z DEBUG 500000 2024-12-04T14:26:01Z DEBUG dnaNextValue: 2024-12-04T14:26:01Z DEBUG 60006 2024-12-04T14:26:01Z DEBUG dnaScope: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:01Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaThreshold: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG dnaType: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass)(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG remove: '(targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass)(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:01Z DEBUG add: '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG add: updated value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Posix IDs 2024-12-04T14:26:01Z DEBUG dnaExcludeScope: 2024-12-04T14:26:01Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaFilter: 2024-12-04T14:26:01Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:01Z DEBUG dnaMagicRegen: 2024-12-04T14:26:01Z DEBUG -1 2024-12-04T14:26:01Z DEBUG dnaMaxValue: 2024-12-04T14:26:01Z DEBUG 500000 2024-12-04T14:26:01Z DEBUG dnaNextValue: 2024-12-04T14:26:01Z DEBUG 60006 2024-12-04T14:26:01Z DEBUG dnaScope: 2024-12-04T14:26:01Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:01Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG dnaThreshold: 2024-12-04T14:26:01Z DEBUG 500 2024-12-04T14:26:01Z DEBUG dnaType: 2024-12-04T14:26:01Z DEBUG uidNumber 2024-12-04T14:26:01Z DEBUG gidNumber 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG extensibleObject 2024-12-04T14:26:01Z DEBUG aci: 2024-12-04T14:26:01Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:01Z DEBUG [] 2024-12-04T14:26:01Z DEBUG Updated 0 2024-12-04T14:26:01Z DEBUG Done 2024-12-04T14:26:01Z DEBUG New entry: cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Initial value 2024-12-04T14:26:01Z DEBUG dn: cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read domain level 2024-12-04T14:26:01Z DEBUG ipapermissiontype: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG --------------------------------------------- 2024-12-04T14:26:01Z DEBUG Final value after applying updates 2024-12-04T14:26:01Z DEBUG dn: cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:01Z DEBUG objectClass: 2024-12-04T14:26:01Z DEBUG top 2024-12-04T14:26:01Z DEBUG groupofnames 2024-12-04T14:26:01Z DEBUG ipapermission 2024-12-04T14:26:01Z DEBUG cn: 2024-12-04T14:26:01Z DEBUG Read domain level 2024-12-04T14:26:01Z DEBUG ipapermissiontype: 2024-12-04T14:26:01Z DEBUG SYSTEM 2024-12-04T14:26:01Z DEBUG member: 2024-12-04T14:26:01Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG masters 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "ipamaxdomainlevel || ipamindomainlevel")(version 3.0;acl "permission:Read domain level";allow (read, search, compare) groupdn = "ldap:///cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipamaxdomainlevel || ipamindomainlevel")(version 3.0;acl "permission:Read domain level";allow (read, search, compare) groupdn = "ldap:///cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG masters 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipamaxdomainlevel || ipamindomainlevel")(version 3.0;acl "permission:Read domain level";allow (read, search, compare) groupdn = "ldap:///cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [(0, 'aci', ['(targetattr = "ipamaxdomainlevel || ipamindomainlevel")(version 3.0;acl "permission:Read domain level";allow (read, search, compare) groupdn = "ldap:///cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'])] 2024-12-04T14:26:02Z DEBUG Updated 1 2024-12-04T14:26:02Z DEBUG update_entry modlist [(0, 'aci', [b'(targetattr = "ipamaxdomainlevel || ipamindomainlevel")(version 3.0;acl "permission:Read domain level";allow (read, search, compare) groupdn = "ldap:///cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'])] 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-replication.update 0.122 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/40-vault.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=vaults,cn=kra,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=vaults,cn=kra,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaVaultContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG vaults 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(version 3.0; acl "Allow users to create private container"; allow (add) userdn = "ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(version 3.0; acl "Allow users to create private container"; allow (add) userdn = "ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(version 3.0; acl "Allow services to create private container"; allow (add) userdn = "ldap:///krbprincipalname=($attr.cn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(version 3.0; acl "Allow services to create private container"; allow (add) userdn = "ldap:///krbprincipalname=($attr.cn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#USERDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#USERDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#GROUPDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#GROUPDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#USERDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#USERDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#GROUPDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#GROUPDN";)' not in aci 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)' from aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG remove: '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)' not in aci 2024-12-04T14:26:02Z DEBUG addifexist: '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)' to aci, current value ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)'] 2024-12-04T14:26:02Z DEBUG addifexist: set aci to ['(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)', '(target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)', '(targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=vaults,cn=kra,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaVaultContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG vaults 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($attr.cn),cn=users,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($attr.cn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/40-vault.update 0.007 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/41-caacl.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=caacls,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=caacls,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG caacls 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Add CA ACL";allow (add) groupdn = "ldap:///cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Delete CA ACL";allow (delete) groupdn = "ldap:///cn=System: Delete CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "hostcategory || ipacacategory || ipacertprofilecategory || ipamemberca || ipamembercertprofile || memberhost || memberservice || memberuser || servicecategory || usercategory")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Manage CA ACL Membership";allow (write) groupdn = "ldap:///cn=System: Manage CA ACL Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipaenabledflag")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Modify CA ACL";allow (write) groupdn = "ldap:///cn=System: Modify CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipacacategory || ipacertprofilecategory || ipaenabledflag || ipamemberca || ipamembercertprofile || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || usercategory")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Read CA ACLs";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=caacls,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG caacls 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Add CA ACL";allow (add) groupdn = "ldap:///cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Delete CA ACL";allow (delete) groupdn = "ldap:///cn=System: Delete CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "hostcategory || ipacacategory || ipacertprofilecategory || ipamemberca || ipamembercertprofile || memberhost || memberservice || memberuser || servicecategory || usercategory")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Manage CA ACL Membership";allow (write) groupdn = "ldap:///cn=System: Manage CA ACL Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipaenabledflag")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Modify CA ACL";allow (write) groupdn = "ldap:///cn=System: Modify CA ACL,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipacacategory || ipacertprofilecategory || ipaenabledflag || ipamemberca || ipamembercertprofile || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || usercategory")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Read CA ACLs";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/41-caacl.update 0.002 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/41-lightweight-cas.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=cas,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=cas,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG cas 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Add CA";allow (add) groupdn = "ldap:///cn=System: Add CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Delete CA";allow (delete) groupdn = "ldap:///cn=System: Delete CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Modify CA";allow (write) groupdn = "ldap:///cn=System: Modify CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipacaid || ipacaissuerdn || ipacasubjectdn || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Read CAs";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=cas,cn=ca,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG cas 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Add CA";allow (add) groupdn = "ldap:///cn=System: Add CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Delete CA";allow (delete) groupdn = "ldap:///cn=System: Delete CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Modify CA";allow (write) groupdn = "ldap:///cn=System: Modify CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipacaid || ipacaissuerdn || ipacasubjectdn || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Read CAs";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/41-lightweight-cas.update 0.002 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/45-roles.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Modify Users and Reset passwords 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Modify Users and Reset passwords 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=helpdesk,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Modify Users and Reset passwords 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Modify Users and Reset passwords 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=helpdesk,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Modify Group membership,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Modify Group membership,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Modify Group membership 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Modify Group membership 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=helpdesk,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Modify Group membership,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Modify Group membership 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Modify Group membership 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=helpdesk,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG User Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Responsible for creating Users and Groups 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Stage User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG User Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Responsible for creating Users and Groups 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Stage User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG User Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG User Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG User Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG User Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add User to default group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Group Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Group Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Group Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Group Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Stage User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Stage User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Stage User Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Stage User Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Stage User Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Stage User Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Stage User Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IT Specialist 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG IT Specialist 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Host Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Service Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Automount Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IT Specialist 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG IT Specialist 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Host Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Service Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Automount Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Administrators 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Host Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Administrators 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Host Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Host Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Group Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Group Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Host Group Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Group Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Group Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Service Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Service Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Service Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Service Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Service Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Service Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Service Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Automount Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Automount Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Automount Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Automount Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Automount Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Automount Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Automount Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IT Security Specialist 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG IT Security Specialist 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IT Security Specialist 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG IT Security Specialist 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Netgroups Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Netgroups Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Netgroups Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Netgroups Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG HBAC Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG HBAC Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=HBAC Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG HBAC Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG HBAC Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Sudo Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Sudo Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Sudo Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Sudo Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Sudo Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=IT Security Specialist,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Security Architect 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Security Architect 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Delegation Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Role Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Security Architect 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Security Architect 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Delegation Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Role Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Delegation Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Delegation Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Delegation Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Role administration 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Role Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Delegation Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Delegation Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Role administration 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Role Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Remove Roles,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Replication Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Replication Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain', 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain', 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Replication Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Replication Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=ipaservers,cn=hostgroups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Write IPA Configuration 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Write IPA Configuration 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Write IPA Configuration 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Write IPA Configuration 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Password Policy Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Password Policy Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Password Policy Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Password Policy Administrator 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Security Architect,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Enrollment Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Enrollment Administrator responsible for client(host) enrollment 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Enrollment Administrator 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Enrollment Administrator responsible for client(host) enrollment 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Enrollment 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Enrollment 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to member, current value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain', 'cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Host Enrollment 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Host Enrollment 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Enrollment Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/45-roles.update 0.072 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-7_bit_check.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG 7-bit check 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG NS7bitAttr 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG NS7bitAttr_Init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libattr-unique-plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG betxnpreoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG 389 Project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG 2.4.6 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:26:02Z DEBUG uid 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:26:02Z DEBUG mail 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:26:02Z DEBUG , 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG replace: userpassword not found, skipping 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=7-bit check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG 7-bit check 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG Enforce 7-bit clean attribute values 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG NS7bitAttr 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG NS7bitAttr_Init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libattr-unique-plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG betxnpreoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG 389 Project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG 2.4.6 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg0: 2024-12-04T14:26:02Z DEBUG uid 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg1: 2024-12-04T14:26:02Z DEBUG mail 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg2: 2024-12-04T14:26:02Z DEBUG , 2024-12-04T14:26:02Z DEBUG nsslapd-pluginarg3: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-7_bit_check.update 0.004 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-dogtag10-migration.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=aclResources,o=ipaca 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=aclResources,o=ipaca 2024-12-04T14:26:02Z DEBUG resourceACLS: 2024-12-04T14:26:02Z DEBUG certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete 2024-12-04T14:26:02Z DEBUG certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter 2024-12-04T14:26:02Z DEBUG certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log 2024-12-04T14:26:02Z DEBUG certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content 2024-12-04T14:26:02Z DEBUG certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content 2024-12-04T14:26:02Z DEBUG certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets 2024-12-04T14:26:02Z DEBUG certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory 2024-12-04T14:26:02Z DEBUG certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate 2024-12-04T14:26:02Z DEBUG certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates 2024-12-04T14:26:02Z DEBUG certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests 2024-12-04T14:26:02Z DEBUG certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request 2024-12-04T14:26:02Z DEBUG certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information 2024-12-04T14:26:02Z DEBUG certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests 2024-12-04T14:26:02Z DEBUG certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl 2024-12-04T14:26:02Z DEBUG certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate 2024-12-04T14:26:02Z DEBUG certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates 2024-12-04T14:26:02Z DEBUG certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain 2024-12-04T14:26:02Z DEBUG certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL 2024-12-04T14:26:02Z DEBUG certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request 2024-12-04T14:26:02Z DEBUG certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status 2024-12-04T14:26:02Z DEBUG certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request 2024-12-04T14:26:02Z DEBUG certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate 2024-12-04T14:26:02Z DEBUG certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request 2024-12-04T14:26:02Z DEBUG certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile 2024-12-04T14:26:02Z DEBUG certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile 2024-12-04T14:26:02Z DEBUG certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles 2024-12-04T14:26:02Z DEBUG certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests 2024-12-04T14:26:02Z DEBUG certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA 2024-12-04T14:26:02Z DEBUG certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics 2024-12-04T14:26:02Z DEBUG certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups 2024-12-04T14:26:02Z DEBUG certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information 2024-12-04T14:26:02Z DEBUG certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent 2024-12-04T14:26:02Z DEBUG certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration. 2024-12-04T14:26:02Z DEBUG certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration. 2024-12-04T14:26:02Z DEBUG certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout 2024-12-04T14:26:02Z DEBUG certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations 2024-12-04T14:26:02Z DEBUG certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations 2024-12-04T14:26:02Z DEBUG certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations 2024-12-04T14:26:02Z DEBUG certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests. 2024-12-04T14:26:02Z DEBUG certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml 2024-12-04T14:26:02Z DEBUG certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG CertACLS 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG aclResources 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout'] 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations'] 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations'] 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations'] 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations'] 2024-12-04T14:26:02Z DEBUG replace: certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group":Anybody is allowed to read domain.xml but only Subsystem group is allowed to modify the domain.xml not found, skipping 2024-12-04T14:26:02Z DEBUG replace: certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml not found, skipping 2024-12-04T14:26:02Z DEBUG replace: certServer.ca.connectorInfo:read,modify:allow (modify,read) group="Enterprise KRA Administrators":Only Enterprise Administrators are allowed to update the connector information not found, skipping 2024-12-04T14:26:02Z DEBUG addifexist: 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles' to resourceACLS, current value ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations'] 2024-12-04T14:26:02Z DEBUG addifexist: set resourceACLS to ['certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete', 'certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify', 'certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify', 'certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify', 'certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter', 'certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log', 'certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content', 'certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify', 'certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify', 'certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify', 'certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets', 'certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify', 'certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify', 'certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify', 'certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify', 'certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify', 'certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory', 'certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate', 'certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates', 'certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests', 'certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request', 'certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information', 'certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests', 'certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl', 'certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate', 'certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates', 'certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain', 'certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL', 'certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request', 'certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status', 'certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request', 'certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate', 'certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request', 'certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile', 'certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles', 'certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile', 'certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles', 'certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles', 'certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests', 'certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA', 'certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics', 'certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups', 'certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information', 'certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent', 'certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.', 'certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests.', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities', 'certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities', 'certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles', 'certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities', 'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml', 'certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations', 'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout', 'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations', 'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations', 'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations', 'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations', 'certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=aclResources,o=ipaca 2024-12-04T14:26:02Z DEBUG resourceACLS: 2024-12-04T14:26:02Z DEBUG certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete 2024-12-04T14:26:02Z DEBUG certServer.policy.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents" ;deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter 2024-12-04T14:26:02Z DEBUG certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log 2024-12-04T14:26:02Z DEBUG certServer.log.content.system:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content 2024-12-04T14:26:02Z DEBUG certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors":Administrators, auditors, and agents are allowed to read the log content 2024-12-04T14:26:02Z DEBUG certServer.ca.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ocsp.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":this acl is shared by all admin servlets 2024-12-04T14:26:02Z DEBUG certServer.profile.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.job.configuration:read,modify:allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.publisher.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.kra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ra.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify) group="Administrators":Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify 2024-12-04T14:26:02Z DEBUG certServer.ca.directory:update:allow (update) group="Certificate Manager Agents":Certificate Manager agents may update directory 2024-12-04T14:26:02Z DEBUG certServer.ca.certificate:import,unrevoke,revoke,read:allow (import,unrevoke,revoke,read) group="Certificate Manager Agents":Certificate Manager agents may import,unrevoke,revoke,read a certificate 2024-12-04T14:26:02Z DEBUG certServer.ca.certificates:revoke,list:allow (revoke,list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents revoke, list certificates 2024-12-04T14:26:02Z DEBUG certServer.ca.requests:list:allow (list) group="Certificate Manager Agents"|| group="Registration Manager Agents":Only certificate and registration manager agents list requests 2024-12-04T14:26:02Z DEBUG certServer.ca.request.enrollment:submit,read,execute,assign,unassign:allow (submit) user="anybody";allow (read,execute,assign,unassign) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read,execute,assign or unassign request 2024-12-04T14:26:02Z DEBUG certServer.ca.ocsp:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may read ocsp information 2024-12-04T14:26:02Z DEBUG certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests 2024-12-04T14:26:02Z DEBUG certServer.ca.crl:read,update:allow (read,update) group="Certificate Manager Agents":Certificate Manager agents may read or update crl 2024-12-04T14:26:02Z DEBUG certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate 2024-12-04T14:26:02Z DEBUG certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates 2024-12-04T14:26:02Z DEBUG certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain 2024-12-04T14:26:02Z DEBUG certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL 2024-12-04T14:26:02Z DEBUG certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request 2024-12-04T14:26:02Z DEBUG certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status 2024-12-04T14:26:02Z DEBUG certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request 2024-12-04T14:26:02Z DEBUG certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate 2024-12-04T14:26:02Z DEBUG certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody";allow (read,execute) group="Certificate Manager Agents":Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request 2024-12-04T14:26:02Z DEBUG certServer.ca.request.profile:approve,read:allow (approve,read) group="Certificate Manager Agents":Certificate Manager agents may approve profile 2024-12-04T14:26:02Z DEBUG certServer.ca.profiles:list:allow (list) group="Certificate Manager Agents":Certificate Manager agents may list profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.profile:read,approve:allow (read,approve) group="Certificate Manager Agents":Certificate Manager agents may read profile 2024-12-04T14:26:02Z DEBUG certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles 2024-12-04T14:26:02Z DEBUG certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.connector:submit:allow (submit) group="Trusted Managers":Only Trusted Managers submit requests 2024-12-04T14:26:02Z DEBUG certServer.ca.clone:submit:allow (submit) group="Certificate Manager Agents":Certificate Manager Agents are allowed to submit request to the master CA 2024-12-04T14:26:02Z DEBUG certServer.ca.systemstatus:read:allow (read) group="Certificate Manager Agents":Certificate Manager agents may view statistics 2024-12-04T14:26:02Z DEBUG certServer.ca.group:read,modify:allow (modify,read) group="Administrators":Only administrators are allowed to read and modify users and groups 2024-12-04T14:26:02Z DEBUG certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information 2024-12-04T14:26:02Z DEBUG certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent 2024-12-04T14:26:02Z DEBUG certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration. 2024-12-04T14:26:02Z DEBUG certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration. 2024-12-04T14:26:02Z DEBUG certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout 2024-12-04T14:26:02Z DEBUG certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations 2024-12-04T14:26:02Z DEBUG certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations 2024-12-04T14:26:02Z DEBUG certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations 2024-12-04T14:26:02Z DEBUG certServer.ca.selftests:read,execute:allow (read,execute) group="Administrators":Only admins can access selftests. 2024-12-04T14:26:02Z DEBUG certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:delete:allow (delete) group="Administrators":Administrators may delete lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles 2024-12-04T14:26:02Z DEBUG certServer.ca.authorities:create,modify,delete:allow (create,modify,delete) group="Certificate Manager Agents":Certificate Manager Agents may manage lightweight authorities 2024-12-04T14:26:02Z DEBUG certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Security Domain Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml 2024-12-04T14:26:02Z DEBUG certServer.ca.certs:execute:allow (execute) group="Enterprise ACME Administrators":ACME Agents may execute cert operations 2024-12-04T14:26:02Z DEBUG certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout 2024-12-04T14:26:02Z DEBUG certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations 2024-12-04T14:26:02Z DEBUG certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations 2024-12-04T14:26:02Z DEBUG certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations 2024-12-04T14:26:02Z DEBUG certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations 2024-12-04T14:26:02Z DEBUG certServer.profile.configuration:read,modify:allow (read,modify) group="Certificate Manager Agents":Certificate Manager agents may modify (create/update/delete) and read profiles 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG CertACLS 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG aclResources 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-dogtag10-migration.update 0.011 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-groupuuid.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG posixgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG ipaNTGroupAttrs 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG admins 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Account administrators group 2024-12-04T14:26:02Z DEBUG gidNumber: 2024-12-04T14:26:02Z DEBUG 60001 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653961dc-ad89-11ef-955b-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaNTSecurityIdentifier: 2024-12-04T14:26:02Z DEBUG S-1-5-21-977849388-641542398-1616376199-512 2024-12-04T14:26:02Z DEBUG add: 'ipaobject' to objectclass, current value ['top', 'groupofnames', 'posixgroup', 'ipausergroup', 'ipaobject', 'nestedGroup', 'ipaNTGroupAttrs'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'groupofnames', 'posixgroup', 'ipausergroup', 'nestedGroup', 'ipaNTGroupAttrs', 'ipaobject'] 2024-12-04T14:26:02Z DEBUG addifnew: 'autogenerate' to ipaUniqueID, current value ['653961dc-ad89-11ef-955b-d21a665e43da'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG posixgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG ipaNTGroupAttrs 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG admins 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Account administrators group 2024-12-04T14:26:02Z DEBUG gidNumber: 2024-12-04T14:26:02Z DEBUG 60001 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653961dc-ad89-11ef-955b-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Replication Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Read domain level,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Host Enrollment,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaNTSecurityIdentifier: 2024-12-04T14:26:02Z DEBUG S-1-5-21-977849388-641542398-1616376199-512 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Default group for all users 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653ab3a2-ad89-11ef-900d-d21a665e43da 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=testuser,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'ipaobject' to objectclass, current value ['top', 'groupofnames', 'nestedgroup', 'ipausergroup', 'ipaobject'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'groupofnames', 'nestedgroup', 'ipausergroup', 'ipaobject'] 2024-12-04T14:26:02Z DEBUG addifnew: 'autogenerate' to ipaUniqueID, current value ['653ab3a2-ad89-11ef-900d-d21a665e43da'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ipausers,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Default group for all users 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653ab3a2-ad89-11ef-900d-d21a665e43da 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=testuser,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=editors,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=editors,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG posixgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG ipantgroupattrs 2024-12-04T14:26:02Z DEBUG gidNumber: 2024-12-04T14:26:02Z DEBUG 60003 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Limited admins who can edit other users 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG editors 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653b08b6-ad89-11ef-bf85-d21a665e43da 2024-12-04T14:26:02Z DEBUG ipaNTSecurityIdentifier: 2024-12-04T14:26:02Z DEBUG S-1-5-21-977849388-641542398-1616376199-1002 2024-12-04T14:26:02Z DEBUG add: 'ipaobject' to objectclass, current value ['top', 'groupofnames', 'posixgroup', 'ipausergroup', 'ipaobject', 'nestedGroup', 'ipantgroupattrs'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'groupofnames', 'posixgroup', 'ipausergroup', 'nestedGroup', 'ipantgroupattrs', 'ipaobject'] 2024-12-04T14:26:02Z DEBUG addifnew: 'autogenerate' to ipaUniqueID, current value ['653b08b6-ad89-11ef-bf85-d21a665e43da'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=editors,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG posixgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG ipantgroupattrs 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG gidNumber: 2024-12-04T14:26:02Z DEBUG 60003 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Limited admins who can edit other users 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG editors 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG 653b08b6-ad89-11ef-bf85-d21a665e43da 2024-12-04T14:26:02Z DEBUG ipaNTSecurityIdentifier: 2024-12-04T14:26:02Z DEBUG S-1-5-21-977849388-641542398-1616376199-1002 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-groupuuid.update 0.011 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-hbacservice.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=crond,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=crond,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG crond 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG crond 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bd1952-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=crond,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG crond 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG crond 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bd1952-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=vsftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=vsftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG vsftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG vsftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bdb236-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=vsftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG vsftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG vsftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bdb236-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=proftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=proftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG proftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG proftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0be2824-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=proftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG proftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG proftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0be2824-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG pure-ftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG pure-ftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bea254-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG pure-ftpd 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG pure-ftpd 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bea254-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=gssftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=gssftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG gssftp 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG gssftp 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bf1b1c-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=gssftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipahbacservice 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG gssftp 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG gssftp 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bf1b1c-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipahbacservicegroup 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG groupOfNames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ftp 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Default group of ftp related services 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=proftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=vsftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=gssftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bfa56e-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ftp,cn=hbacservicegroups,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipahbacservicegroup 2024-12-04T14:26:02Z DEBUG nestedGroup 2024-12-04T14:26:02Z DEBUG groupOfNames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ftp 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Default group of ftp related services 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=ftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=proftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=vsftpd,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=gssftp,cn=hbacservices,cn=hbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0bfa56e-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-hbacservice.update 0.016 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-ipaconfig.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaGuiConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaUserAuthTypeClass 2024-12-04T14:26:02Z DEBUG ipaNameResolutionData 2024-12-04T14:26:02Z DEBUG ipaUserSearchFields: 2024-12-04T14:26:02Z DEBUG uid,givenname,sn,telephonenumber,ou,title 2024-12-04T14:26:02Z DEBUG ipaGroupSearchFields: 2024-12-04T14:26:02Z DEBUG cn,description 2024-12-04T14:26:02Z DEBUG ipaSearchTimeLimit: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG ipaSearchRecordsLimit: 2024-12-04T14:26:02Z DEBUG 100 2024-12-04T14:26:02Z DEBUG ipaHomesRootDir: 2024-12-04T14:26:02Z DEBUG /home 2024-12-04T14:26:02Z DEBUG ipaDefaultLoginShell: 2024-12-04T14:26:02Z DEBUG /bin/bash 2024-12-04T14:26:02Z DEBUG ipaDefaultPrimaryGroup: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaMaxUsernameLength: 2024-12-04T14:26:02Z DEBUG 32 2024-12-04T14:26:02Z DEBUG ipaMaxHostnameLength: 2024-12-04T14:26:02Z DEBUG 64 2024-12-04T14:26:02Z DEBUG ipaPwdExpAdvNotify: 2024-12-04T14:26:02Z DEBUG 4 2024-12-04T14:26:02Z DEBUG ipaGroupObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipaUserObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG person 2024-12-04T14:26:02Z DEBUG organizationalperson 2024-12-04T14:26:02Z DEBUG inetorgperson 2024-12-04T14:26:02Z DEBUG inetuser 2024-12-04T14:26:02Z DEBUG posixaccount 2024-12-04T14:26:02Z DEBUG krbprincipalaux 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipasshuser 2024-12-04T14:26:02Z DEBUG ipaDefaultEmailDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaMigrationEnabled: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG ipaConfigString: 2024-12-04T14:26:02Z DEBUG AllowNThash 2024-12-04T14:26:02Z DEBUG KDC:Disable Last Success 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapOrder: 2024-12-04T14:26:02Z DEBUG generic_u3:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$officer_u:s0-s3:c0.c15$generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapDefault: 2024-12-04T14:26:02Z DEBUG generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipaConfig 2024-12-04T14:26:02Z DEBUG ipaCertificateSubjectBase: 2024-12-04T14:26:02Z DEBUG O=FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaKrbAuthzData: 2024-12-04T14:26:02Z DEBUG MS-PAC 2024-12-04T14:26:02Z DEBUG nfs:NONE 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG replace: ipaSELinuxUserMapOrder: officer_u:s0-s3:c0.c15$generic3_u:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$generic_u:s0-s3:c0.c15 not found, skipping 2024-12-04T14:26:02Z DEBUG replace: officer_u:s0-s3:c0.c15$generic3_u:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$generic_u:s0-s3:c0.c15 not found, skipping 2024-12-04T14:26:02Z DEBUG add: 'generic_u:s0-s3:c0.c15' to ipaSELinuxUserMapDefault, current value ['generic_u:s0-s3:c0.c15'] 2024-12-04T14:26:02Z DEBUG add: updated value ['generic_u:s0-s3:c0.c15'] 2024-12-04T14:26:02Z DEBUG add: 'ipasshuser' to ipaUserObjectClasses, current value ['top', 'person', 'organizationalperson', 'inetorgperson', 'inetuser', 'posixaccount', 'krbprincipalaux', 'krbticketpolicyaux', 'ipaobject', 'ipasshuser'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'person', 'organizationalperson', 'inetorgperson', 'inetuser', 'posixaccount', 'krbprincipalaux', 'krbticketpolicyaux', 'ipaobject', 'ipasshuser'] 2024-12-04T14:26:02Z DEBUG remove: 'AllowLMhash' from ipaConfigString, current value ['AllowNThash', 'KDC:Disable Last Success'] 2024-12-04T14:26:02Z DEBUG remove: 'AllowLMhash' not in ipaConfigString 2024-12-04T14:26:02Z DEBUG add: 'ipaUserAuthTypeClass' to objectClass, current value ['nsContainer', 'top', 'ipaGuiConfig', 'ipaConfigObject', 'ipaUserAuthTypeClass', 'ipaNameResolutionData'] 2024-12-04T14:26:02Z DEBUG add: updated value ['nsContainer', 'top', 'ipaGuiConfig', 'ipaConfigObject', 'ipaNameResolutionData', 'ipaUserAuthTypeClass'] 2024-12-04T14:26:02Z DEBUG add: 'ipaNameResolutionData' to objectClass, current value ['nsContainer', 'top', 'ipaGuiConfig', 'ipaConfigObject', 'ipaNameResolutionData', 'ipaUserAuthTypeClass'] 2024-12-04T14:26:02Z DEBUG add: updated value ['nsContainer', 'top', 'ipaGuiConfig', 'ipaConfigObject', 'ipaUserAuthTypeClass', 'ipaNameResolutionData'] 2024-12-04T14:26:02Z DEBUG addifnew: '64' to ipamaxhostnamelength, current value ['64'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaGuiConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaUserAuthTypeClass 2024-12-04T14:26:02Z DEBUG ipaNameResolutionData 2024-12-04T14:26:02Z DEBUG ipaUserSearchFields: 2024-12-04T14:26:02Z DEBUG uid,givenname,sn,telephonenumber,ou,title 2024-12-04T14:26:02Z DEBUG ipaGroupSearchFields: 2024-12-04T14:26:02Z DEBUG cn,description 2024-12-04T14:26:02Z DEBUG ipaSearchTimeLimit: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG ipaSearchRecordsLimit: 2024-12-04T14:26:02Z DEBUG 100 2024-12-04T14:26:02Z DEBUG ipaHomesRootDir: 2024-12-04T14:26:02Z DEBUG /home 2024-12-04T14:26:02Z DEBUG ipaDefaultLoginShell: 2024-12-04T14:26:02Z DEBUG /bin/bash 2024-12-04T14:26:02Z DEBUG ipaDefaultPrimaryGroup: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaMaxUsernameLength: 2024-12-04T14:26:02Z DEBUG 32 2024-12-04T14:26:02Z DEBUG ipaMaxHostnameLength: 2024-12-04T14:26:02Z DEBUG 64 2024-12-04T14:26:02Z DEBUG ipaPwdExpAdvNotify: 2024-12-04T14:26:02Z DEBUG 4 2024-12-04T14:26:02Z DEBUG ipaGroupObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipaUserObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG person 2024-12-04T14:26:02Z DEBUG organizationalperson 2024-12-04T14:26:02Z DEBUG inetorgperson 2024-12-04T14:26:02Z DEBUG inetuser 2024-12-04T14:26:02Z DEBUG posixaccount 2024-12-04T14:26:02Z DEBUG krbprincipalaux 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipasshuser 2024-12-04T14:26:02Z DEBUG ipaDefaultEmailDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaMigrationEnabled: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG ipaConfigString: 2024-12-04T14:26:02Z DEBUG AllowNThash 2024-12-04T14:26:02Z DEBUG KDC:Disable Last Success 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapOrder: 2024-12-04T14:26:02Z DEBUG generic_u3:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$officer_u:s0-s3:c0.c15$generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapDefault: 2024-12-04T14:26:02Z DEBUG generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipaConfig 2024-12-04T14:26:02Z DEBUG ipaCertificateSubjectBase: 2024-12-04T14:26:02Z DEBUG O=FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaKrbAuthzData: 2024-12-04T14:26:02Z DEBUG MS-PAC 2024-12-04T14:26:02Z DEBUG nfs:NONE 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-ipaconfig.update 0.010 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-krbenctypes.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG krbrealmcontainer 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG krbSubTrees: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG krbSearchScope: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG krbSupportedEncSaltTypes: 2024-12-04T14:26:02Z DEBUG aes256-cts:normal 2024-12-04T14:26:02Z DEBUG aes256-cts:special 2024-12-04T14:26:02Z DEBUG aes128-cts:normal 2024-12-04T14:26:02Z DEBUG aes128-cts:special 2024-12-04T14:26:02Z DEBUG aes128-sha2:normal 2024-12-04T14:26:02Z DEBUG aes128-sha2:special 2024-12-04T14:26:02Z DEBUG aes256-sha2:normal 2024-12-04T14:26:02Z DEBUG aes256-sha2:special 2024-12-04T14:26:02Z DEBUG camellia128-cts-cmac:normal 2024-12-04T14:26:02Z DEBUG camellia128-cts-cmac:special 2024-12-04T14:26:02Z DEBUG camellia256-cts-cmac:normal 2024-12-04T14:26:02Z DEBUG camellia256-cts-cmac:special 2024-12-04T14:26:02Z DEBUG krbMaxTicketLife: 2024-12-04T14:26:02Z DEBUG 86400 2024-12-04T14:26:02Z DEBUG krbMaxRenewableAge: 2024-12-04T14:26:02Z DEBUG 604800 2024-12-04T14:26:02Z DEBUG krbDefaultEncSaltTypes: 2024-12-04T14:26:02Z DEBUG aes256-sha2:special 2024-12-04T14:26:02Z DEBUG aes128-sha2:special 2024-12-04T14:26:02Z DEBUG aes256-cts:special 2024-12-04T14:26:02Z DEBUG aes128-cts:special 2024-12-04T14:26:02Z DEBUG krbMKey: 2024-12-04T14:26:02Z DEBUG XXXXXXXX 2024-12-04T14:26:02Z DEBUG krbPwdPolicyReference: 2024-12-04T14:26:02Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || krbauthindmaxrenewableage || krbauthindmaxticketlife || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || cospriority || createtimestamp || entryusn || ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || modifytimestamp || objectclass || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Read Group Password Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: 'camellia128-cts-cmac:normal' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal'] 2024-12-04T14:26:02Z DEBUG add: 'camellia128-cts-cmac:special' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special'] 2024-12-04T14:26:02Z DEBUG add: 'camellia256-cts-cmac:normal' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal'] 2024-12-04T14:26:02Z DEBUG add: 'camellia256-cts-cmac:special' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia256-cts-cmac:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special'] 2024-12-04T14:26:02Z DEBUG add: 'aes128-sha2:normal' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal'] 2024-12-04T14:26:02Z DEBUG add: 'aes128-sha2:special' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal', 'aes128-sha2:special'] 2024-12-04T14:26:02Z DEBUG add: 'aes256-sha2:normal' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes256-sha2:normal', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal', 'aes128-sha2:special'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal'] 2024-12-04T14:26:02Z DEBUG add: 'aes256-sha2:special' to krbSupportedEncSaltTypes, current value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'aes256-sha2:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal'] 2024-12-04T14:26:02Z DEBUG add: updated value ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'camellia128-cts-cmac:normal', 'camellia128-cts-cmac:special', 'camellia256-cts-cmac:normal', 'camellia256-cts-cmac:special', 'aes128-sha2:normal', 'aes128-sha2:special', 'aes256-sha2:normal', 'aes256-sha2:special'] 2024-12-04T14:26:02Z DEBUG remove: 'des3-hmac-sha1:special' from krbDefaultEncSaltTypes, current value ['aes256-sha2:special', 'aes128-sha2:special', 'aes256-cts:special', 'aes128-cts:special'] 2024-12-04T14:26:02Z DEBUG remove: 'des3-hmac-sha1:special' not in krbDefaultEncSaltTypes 2024-12-04T14:26:02Z DEBUG remove: 'arcfour-hmac:special' from krbDefaultEncSaltTypes, current value ['aes256-sha2:special', 'aes128-sha2:special', 'aes256-cts:special', 'aes128-cts:special'] 2024-12-04T14:26:02Z DEBUG remove: 'arcfour-hmac:special' not in krbDefaultEncSaltTypes 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG krbrealmcontainer 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG krbSubTrees: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG krbSearchScope: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG krbSupportedEncSaltTypes: 2024-12-04T14:26:02Z DEBUG aes256-cts:normal 2024-12-04T14:26:02Z DEBUG aes256-cts:special 2024-12-04T14:26:02Z DEBUG aes128-cts:normal 2024-12-04T14:26:02Z DEBUG aes128-cts:special 2024-12-04T14:26:02Z DEBUG camellia128-cts-cmac:normal 2024-12-04T14:26:02Z DEBUG camellia128-cts-cmac:special 2024-12-04T14:26:02Z DEBUG camellia256-cts-cmac:normal 2024-12-04T14:26:02Z DEBUG camellia256-cts-cmac:special 2024-12-04T14:26:02Z DEBUG aes128-sha2:normal 2024-12-04T14:26:02Z DEBUG aes128-sha2:special 2024-12-04T14:26:02Z DEBUG aes256-sha2:normal 2024-12-04T14:26:02Z DEBUG aes256-sha2:special 2024-12-04T14:26:02Z DEBUG krbMaxTicketLife: 2024-12-04T14:26:02Z DEBUG 86400 2024-12-04T14:26:02Z DEBUG krbMaxRenewableAge: 2024-12-04T14:26:02Z DEBUG 604800 2024-12-04T14:26:02Z DEBUG krbDefaultEncSaltTypes: 2024-12-04T14:26:02Z DEBUG aes256-sha2:special 2024-12-04T14:26:02Z DEBUG aes128-sha2:special 2024-12-04T14:26:02Z DEBUG aes256-cts:special 2024-12-04T14:26:02Z DEBUG aes128-cts:special 2024-12-04T14:26:02Z DEBUG krbMKey: 2024-12-04T14:26:02Z DEBUG XXXXXXXX 2024-12-04T14:26:02Z DEBUG krbPwdPolicyReference: 2024-12-04T14:26:02Z DEBUG cn=Default Kerberos Service Password Policy,cn=Kerberos Service Password Policy,cn=FREEIPA.TESTDOMAIN,cn=kerberos,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || krbauthindmaxrenewableage || krbauthindmaxticketlife || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || cospriority || createtimestamp || entryusn || ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || modifytimestamp || objectclass || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Read Group Password Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-krbenctypes.update 0.006 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/50-nis.update' 2024-12-04T14:26:02Z DEBUG Executing upgrade plugin: update_nis_configuration 2024-12-04T14:26:02Z DEBUG raw: update_nis_configuration 2024-12-04T14:26:02Z DEBUG Skipping NIS update, NIS Server is not configured 2024-12-04T14:26:02Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:26:02Z DEBUG Saving StateFile to '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/50-nis.update 0.004 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/55-pbacmemberof.update' 2024-12-04T14:26:02Z DEBUG New entry: cn=Update PBAC memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Update PBAC memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG add: 'top' to objectClass, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['top'] 2024-12-04T14:26:02Z DEBUG add: 'extensibleObject' to objectClass, current value ['top'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: 'IPA PBAC memberOf 1733322358' to cn, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['IPA PBAC memberOf 1733322358'] 2024-12-04T14:26:02Z DEBUG add: 'cn=privileges,cn=pbac,dc=freeipa,dc=testdomain' to basedn, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=privileges,cn=pbac,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: '(objectclass=*)' to filter, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['(objectclass=*)'] 2024-12-04T14:26:02Z DEBUG add: '10' to ttl, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['10'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Update PBAC memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IPA PBAC memberOf 1733322358 2024-12-04T14:26:02Z DEBUG basedn: 2024-12-04T14:26:02Z DEBUG cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG filter: 2024-12-04T14:26:02Z DEBUG (objectclass=*) 2024-12-04T14:26:02Z DEBUG ttl: 2024-12-04T14:26:02Z DEBUG 10 2024-12-04T14:26:02Z DEBUG New entry: cn=Update Role memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Update Role memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG add: 'top' to objectClass, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['top'] 2024-12-04T14:26:02Z DEBUG add: 'extensibleObject' to objectClass, current value ['top'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: 'Update Role memberOf 1733322358' to cn, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['Update Role memberOf 1733322358'] 2024-12-04T14:26:02Z DEBUG add: 'cn=roles,cn=accounts,dc=freeipa,dc=testdomain' to basedn, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=roles,cn=accounts,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: '(objectclass=*)' to filter, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['(objectclass=*)'] 2024-12-04T14:26:02Z DEBUG add: '10' to ttl, current value [] 2024-12-04T14:26:02Z DEBUG add: updated value ['10'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Update Role memberOf 1733322358,cn=memberof task,cn=tasks,cn=config 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Update Role memberOf 1733322358 2024-12-04T14:26:02Z DEBUG basedn: 2024-12-04T14:26:02Z DEBUG cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG filter: 2024-12-04T14:26:02Z DEBUG (objectclass=*) 2024-12-04T14:26:02Z DEBUG ttl: 2024-12-04T14:26:02Z DEBUG 10 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/55-pbacmemberof.update 0.040 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/59-trusts-sysacount.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG GroupOfNames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG adtrust agents 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ADTrust Agents,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG krbprincipalname=cifs/dc.freeipa.testdomain@freeipa.testdomain,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'nestedgroup' to objectClass, current value ['GroupOfNames', 'top', 'nestedgroup'] 2024-12-04T14:26:02Z DEBUG add: updated value ['GroupOfNames', 'top', 'nestedgroup'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG GroupOfNames 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG adtrust agents 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=ADTrust Agents,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG krbprincipalname=cifs/dc.freeipa.testdomain@freeipa.testdomain,cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG fqdn=dc.freeipa.testdomain,cn=computers,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/59-trusts-sysacount.update 0.004 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/60-trusts.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trust admins 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Trusts administrators group 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0d53cbc-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trust admins 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Trusts administrators group 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG uid=admin,cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG ipaUniqueID: 2024-12-04T14:26:02Z DEBUG e0d53cbc-ad89-11ef-8167-d21a665e43da 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ADTrust Agents,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ADTrust Agents,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ADTrust Agents 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG System accounts able to access trust information 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ADTrust Agents,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ADTrust Agents 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG System accounts able to access trust information 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trusts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trusts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trusts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)' to aci, current value ['(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG add: '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG replace: updated value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG replace: (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) not found, skipping 2024-12-04T14:26:02Z DEBUG add: '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG trusts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Allow trust agents to retrieve keytab keys for cross realm principals"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Allow trust agents to set keys for cross realm principals"; allow(write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing || krbPrincipalName || krbLastPwdChange || krbTicketFlags || krbLoginFailedCount || krbExtraData || krbPrincipalKey")(version 3.0;acl "Allow trust system user to create and delete trust accounts and cross realm principals"; allow (read,write,add,delete) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=trusts,dc=freeipa,dc=testdomain")(targetattr = "ipaNTTrustType || ipaNTTrustAttributes || ipaNTTrustDirection || ipaNTTrustPartner || ipaNTFlatName || ipaNTTrustAuthOutgoing || ipaNTTrustAuthIncoming || ipaNTSecurityIdentifier || ipaNTTrustForestTrustInfo || ipaNTTrustPosixOffset || ipaNTSupportedEncryptionTypes || ipaNTSIDBlacklistIncoming || ipaNTSIDBlacklistOutgoing")(version 3.0;acl "Allow trust admins manage trust accounts"; allow (read,write,add,delete) groupdn="ldap:///cn=trust admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about trusted domain objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG domain 2024-12-04T14:26:02Z DEBUG pilotObject 2024-12-04T14:26:02Z DEBUG domainRelatedObject 2024-12-04T14:26:02Z DEBUG nisDomainObject 2024-12-04T14:26:02Z DEBUG dc: 2024-12-04T14:26:02Z DEBUG freeipa 2024-12-04T14:26:02Z DEBUG info: 2024-12-04T14:26:02Z DEBUG IPA V2.0 2024-12-04T14:26:02Z DEBUG nisDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG associatedDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read NT passwords"; allow (read) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' from aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG remove: '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read NT passwords"; allow (read) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' not in aci 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG domain 2024-12-04T14:26:02Z DEBUG pilotObject 2024-12-04T14:26:02Z DEBUG domainRelatedObject 2024-12-04T14:26:02Z DEBUG nisDomainObject 2024-12-04T14:26:02Z DEBUG dc: 2024-12-04T14:26:02Z DEBUG freeipa 2024-12-04T14:26:02Z DEBUG info: 2024-12-04T14:26:02Z DEBUG IPA V2.0 2024-12-04T14:26:02Z DEBUG nisDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG associatedDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG accounts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";)', '(targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";)', '(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";)', '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG accounts 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policy"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "Admins can manage delegations"; allow (write, delete) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Users allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;read_keys")(version 3.0; acl "Groups allowed to retrieve keytab keys"; allow(read) userattr="ipaAllowedToPerform;read_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Users allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Groups allowed to create keytab keys"; allow(write) userattr="ipaAllowedToPerform;write_keys#GROUPDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey themselves"; allow(write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Admins are allowed to rekey any entity"; allow(write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targetattr="ipaProtectedOperation;write_keys")(version 3.0; acl "Entities are allowed to rekey managed entries"; allow(write) userattr="managedby#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "Allow reading POSIX information about users and group objects";allow (compare,read,search) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG services 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)' to aci, current value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG add: '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)' to aci, current value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)', '(target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=services,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG services 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "Admins can manage service keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="userCertificate || krbPrincipalKey")(version 3.0; acl "Hosts can manage service Certificates and kerberos keys"; allow(write) userattr = "parent[0,1].managedby#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///krbprincipalname=*/($dn)@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can delete own services"; allow(delete) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:26:02Z DEBUG (target="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($dn),cn=services,cn=accounts,dc=freeipa,dc=testdomain" or userattr="managedby#SELFDN";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaGuiConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaUserAuthTypeClass 2024-12-04T14:26:02Z DEBUG ipaNameResolutionData 2024-12-04T14:26:02Z DEBUG ipaUserSearchFields: 2024-12-04T14:26:02Z DEBUG uid,givenname,sn,telephonenumber,ou,title 2024-12-04T14:26:02Z DEBUG ipaGroupSearchFields: 2024-12-04T14:26:02Z DEBUG cn,description 2024-12-04T14:26:02Z DEBUG ipaSearchTimeLimit: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG ipaSearchRecordsLimit: 2024-12-04T14:26:02Z DEBUG 100 2024-12-04T14:26:02Z DEBUG ipaHomesRootDir: 2024-12-04T14:26:02Z DEBUG /home 2024-12-04T14:26:02Z DEBUG ipaDefaultLoginShell: 2024-12-04T14:26:02Z DEBUG /bin/bash 2024-12-04T14:26:02Z DEBUG ipaDefaultPrimaryGroup: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaMaxUsernameLength: 2024-12-04T14:26:02Z DEBUG 32 2024-12-04T14:26:02Z DEBUG ipaMaxHostnameLength: 2024-12-04T14:26:02Z DEBUG 64 2024-12-04T14:26:02Z DEBUG ipaPwdExpAdvNotify: 2024-12-04T14:26:02Z DEBUG 4 2024-12-04T14:26:02Z DEBUG ipaGroupObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipaUserObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG person 2024-12-04T14:26:02Z DEBUG organizationalperson 2024-12-04T14:26:02Z DEBUG inetorgperson 2024-12-04T14:26:02Z DEBUG inetuser 2024-12-04T14:26:02Z DEBUG posixaccount 2024-12-04T14:26:02Z DEBUG krbprincipalaux 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipasshuser 2024-12-04T14:26:02Z DEBUG ipaDefaultEmailDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaMigrationEnabled: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG ipaConfigString: 2024-12-04T14:26:02Z DEBUG AllowNThash 2024-12-04T14:26:02Z DEBUG KDC:Disable Last Success 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapOrder: 2024-12-04T14:26:02Z DEBUG generic_u3:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$officer_u:s0-s3:c0.c15$generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapDefault: 2024-12-04T14:26:02Z DEBUG generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipaConfig 2024-12-04T14:26:02Z DEBUG ipaCertificateSubjectBase: 2024-12-04T14:26:02Z DEBUG O=FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaKrbAuthzData: 2024-12-04T14:26:02Z DEBUG MS-PAC 2024-12-04T14:26:02Z DEBUG nfs:NONE 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG add: 'MS-PAC' to ipaKrbAuthzData, current value ['MS-PAC', 'nfs:NONE'] 2024-12-04T14:26:02Z DEBUG add: updated value ['nfs:NONE', 'MS-PAC'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ipaConfig,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaGuiConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaUserAuthTypeClass 2024-12-04T14:26:02Z DEBUG ipaNameResolutionData 2024-12-04T14:26:02Z DEBUG ipaUserSearchFields: 2024-12-04T14:26:02Z DEBUG uid,givenname,sn,telephonenumber,ou,title 2024-12-04T14:26:02Z DEBUG ipaGroupSearchFields: 2024-12-04T14:26:02Z DEBUG cn,description 2024-12-04T14:26:02Z DEBUG ipaSearchTimeLimit: 2024-12-04T14:26:02Z DEBUG 2 2024-12-04T14:26:02Z DEBUG ipaSearchRecordsLimit: 2024-12-04T14:26:02Z DEBUG 100 2024-12-04T14:26:02Z DEBUG ipaHomesRootDir: 2024-12-04T14:26:02Z DEBUG /home 2024-12-04T14:26:02Z DEBUG ipaDefaultLoginShell: 2024-12-04T14:26:02Z DEBUG /bin/bash 2024-12-04T14:26:02Z DEBUG ipaDefaultPrimaryGroup: 2024-12-04T14:26:02Z DEBUG ipausers 2024-12-04T14:26:02Z DEBUG ipaMaxUsernameLength: 2024-12-04T14:26:02Z DEBUG 32 2024-12-04T14:26:02Z DEBUG ipaMaxHostnameLength: 2024-12-04T14:26:02Z DEBUG 64 2024-12-04T14:26:02Z DEBUG ipaPwdExpAdvNotify: 2024-12-04T14:26:02Z DEBUG 4 2024-12-04T14:26:02Z DEBUG ipaGroupObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG ipausergroup 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipaUserObjectClasses: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG person 2024-12-04T14:26:02Z DEBUG organizationalperson 2024-12-04T14:26:02Z DEBUG inetorgperson 2024-12-04T14:26:02Z DEBUG inetuser 2024-12-04T14:26:02Z DEBUG posixaccount 2024-12-04T14:26:02Z DEBUG krbprincipalaux 2024-12-04T14:26:02Z DEBUG krbticketpolicyaux 2024-12-04T14:26:02Z DEBUG ipaobject 2024-12-04T14:26:02Z DEBUG ipasshuser 2024-12-04T14:26:02Z DEBUG ipaDefaultEmailDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaMigrationEnabled: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG ipaConfigString: 2024-12-04T14:26:02Z DEBUG AllowNThash 2024-12-04T14:26:02Z DEBUG KDC:Disable Last Success 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapOrder: 2024-12-04T14:26:02Z DEBUG generic_u3:s3-s3:c0.c15$generic_u2:s2-s3:c0.c15$generic_u1:s1-s3:c0.c15$officer_u:s0-s3:c0.c15$generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG ipaSELinuxUserMapDefault: 2024-12-04T14:26:02Z DEBUG generic_u:s0-s3:c0.c15 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipaConfig 2024-12-04T14:26:02Z DEBUG ipaCertificateSubjectBase: 2024-12-04T14:26:02Z DEBUG O=FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaKrbAuthzData: 2024-12-04T14:26:02Z DEBUG nfs:NONE 2024-12-04T14:26:02Z DEBUG MS-PAC 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/60-trusts.update 0.036 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/61-trusts-s4u2proxy.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupOfPrincipals 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipa-cifs-delegation-targets 2024-12-04T14:26:02Z DEBUG memberPrincipal: 2024-12-04T14:26:02Z DEBUG cifs/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupOfPrincipals 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipa-cifs-delegation-targets 2024-12-04T14:26:02Z DEBUG memberPrincipal: 2024-12-04T14:26:02Z DEBUG cifs/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:02Z DEBUG groupOfPrincipals 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipa-http-delegation 2024-12-04T14:26:02Z DEBUG memberPrincipal: 2024-12-04T14:26:02Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:02Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG add: 'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain' to ipaAllowedTarget, current value ['cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain', 'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain', 'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG ipaKrb5DelegationACL 2024-12-04T14:26:02Z DEBUG groupOfPrincipals 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ipa-http-delegation 2024-12-04T14:26:02Z DEBUG memberPrincipal: 2024-12-04T14:26:02Z DEBUG HTTP/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN 2024-12-04T14:26:02Z DEBUG ipaAllowedTarget: 2024-12-04T14:26:02Z DEBUG cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/61-trusts-s4u2proxy.update 0.006 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/62-ranges.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ranges 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ranges 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=*,cn=ranges,cn=etc,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=IPA Range-Check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=IPA Range-Check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IPA Range-Check 2024-12-04T14:26:02Z DEBUG nsslapd-basedn: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG Check if newly added or modified ID ranges do not overlap with existing ones 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG IPA ID range check plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG ipa_range_check_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libipa_range_check 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG preoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG FreeIPA project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG FreeIPA/1.0 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=IPA Range-Check,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG IPA Range-Check 2024-12-04T14:26:02Z DEBUG nsslapd-basedn: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG Check if newly added or modified ID ranges do not overlap with existing ones 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG IPA ID range check plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG ipa_range_check_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libipa_range_check 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG preoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG FreeIPA project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG FreeIPA/1.0 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Posix IDs 2024-12-04T14:26:02Z DEBUG dnaExcludeScope: 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaFilter: 2024-12-04T14:26:02Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:02Z DEBUG dnaMagicRegen: 2024-12-04T14:26:02Z DEBUG -1 2024-12-04T14:26:02Z DEBUG dnaMaxValue: 2024-12-04T14:26:02Z DEBUG 500000 2024-12-04T14:26:02Z DEBUG dnaNextValue: 2024-12-04T14:26:02Z DEBUG 60006 2024-12-04T14:26:02Z DEBUG dnaScope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:02Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaThreshold: 2024-12-04T14:26:02Z DEBUG 500 2024-12-04T14:26:02Z DEBUG dnaType: 2024-12-04T14:26:02Z DEBUG uidNumber 2024-12-04T14:26:02Z DEBUG gidNumber 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG replace: (|(objectclass=posixAccount)(objectClass=posixGroup)) not found, skipping 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Posix IDs 2024-12-04T14:26:02Z DEBUG dnaExcludeScope: 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaFilter: 2024-12-04T14:26:02Z DEBUG (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ipaIDobject)) 2024-12-04T14:26:02Z DEBUG dnaMagicRegen: 2024-12-04T14:26:02Z DEBUG -1 2024-12-04T14:26:02Z DEBUG dnaMaxValue: 2024-12-04T14:26:02Z DEBUG 500000 2024-12-04T14:26:02Z DEBUG dnaNextValue: 2024-12-04T14:26:02Z DEBUG 60006 2024-12-04T14:26:02Z DEBUG dnaScope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:02Z DEBUG cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaThreshold: 2024-12-04T14:26:02Z DEBUG 500 2024-12-04T14:26:02Z DEBUG dnaType: 2024-12-04T14:26:02Z DEBUG uidNumber 2024-12-04T14:26:02Z DEBUG gidNumber 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/62-ranges.update 0.134 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/71-idviews-sasl-mapping.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ID Overridden Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ID Overridden Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ID Overridden Principal 2024-12-04T14:26:02Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:26:02Z DEBUG cn=default trust view,cn=views,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:26:02Z DEBUG (&(ipaoriginaluid=\1@\2)(objectclass=ipaUserOverride)) 2024-12-04T14:26:02Z DEBUG nsSaslMapPriority: 2024-12-04T14:26:02Z DEBUG 20 2024-12-04T14:26:02Z DEBUG nsSaslMapRegexString: 2024-12-04T14:26:02Z DEBUG \(.*\)@\(.*\) 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSaslMapping 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ID Overridden Principal,cn=mapping,cn=sasl,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ID Overridden Principal 2024-12-04T14:26:02Z DEBUG nsSaslMapBaseDNTemplate: 2024-12-04T14:26:02Z DEBUG cn=default trust view,cn=views,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG nsSaslMapFilterTemplate: 2024-12-04T14:26:02Z DEBUG (&(ipaoriginaluid=\1@\2)(objectclass=ipaUserOverride)) 2024-12-04T14:26:02Z DEBUG nsSaslMapPriority: 2024-12-04T14:26:02Z DEBUG 20 2024-12-04T14:26:02Z DEBUG nsSaslMapRegexString: 2024-12-04T14:26:02Z DEBUG \(.*\)@\(.*\) 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSaslMapping 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/71-idviews-sasl-mapping.update 0.003 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/71-idviews.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=views,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=views,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG views 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || memberof || modifytimestamp || objectclass || uid || uidnumber || usercertificate")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipadomainresolutionorder || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=views,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG views 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || memberof || modifytimestamp || objectclass || uid || uidnumber || usercertificate")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipadomainresolutionorder || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/71-idviews.update 0.002 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/72-domainlevels.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Domain Level,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Domain Level,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaDomainLevelConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Domain Level 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipadomainlevel || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipadomainlevelconfig)")(version 3.0;acl "permission:System: Read Domain Level";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Domain Level,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaDomainLevelConfig 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Domain Level 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || ipadomainlevel || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipadomainlevelconfig)")(version 3.0;acl "permission:System: Read Domain Level";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG o=ipaca 2024-12-04T14:26:02Z DEBUG ipaMinDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG add: 'ipaConfigObject' to objectClass, current value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaSupportedDomainLevelConfig', 'ipaConfigObject'] 2024-12-04T14:26:02Z DEBUG add: 'ipaSupportedDomainLevelConfig' to objectClass, current value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaSupportedDomainLevelConfig', 'ipaConfigObject'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig'] 2024-12-04T14:26:02Z DEBUG only: set ipaMinDomainLevel to '1', current value ['1'] 2024-12-04T14:26:02Z DEBUG only: updated value ['1'] 2024-12-04T14:26:02Z DEBUG only: set ipaMaxDomainLevel to '1', current value ['1'] 2024-12-04T14:26:02Z DEBUG only: updated value ['1'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:26:02Z DEBUG ipaConfigObject 2024-12-04T14:26:02Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:02Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG o=ipaca 2024-12-04T14:26:02Z DEBUG ipaMinDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:26:02Z DEBUG 1 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/72-domainlevels.update 0.005 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/73-certmap.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaCertMapConfigObject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG certmap 2024-12-04T14:26:02Z DEBUG ipaCertMapPromptUsername: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Modify Certmap Configuration";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Read Certmap Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG ipaCertMapConfigObject 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG certmap 2024-12-04T14:26:02Z DEBUG ipaCertMapPromptUsername: 2024-12-04T14:26:02Z DEBUG FALSE 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Modify Certmap Configuration";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Read Certmap Configuration";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=certmaprules,cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=certmaprules,cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG certmaprules 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Add Certmap Rules";allow (add) groupdn = "ldap:///cn=System: Add Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Delete Certmap Rules";allow (delete) groupdn = "ldap:///cn=System: Delete Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "associateddomain || cn || description || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Modify Certmap Rules";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "associateddomain || cn || createtimestamp || description || entryusn || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Read Certmap Rules";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=certmaprules,cn=certmap,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG certmaprules 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Add Certmap Rules";allow (add) groupdn = "ldap:///cn=System: Add Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Delete Certmap Rules";allow (delete) groupdn = "ldap:///cn=System: Delete Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "associateddomain || cn || description || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Modify Certmap Rules";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "associateddomain || cn || createtimestamp || description || entryusn || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Read Certmap Rules";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Certificate Identity Mapping Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Certificate Identity Mapping Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Certificate Identity Mapping Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Certificate Identity Mapping Administrators 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify Certmap Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Certificate Identity Mapping Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Certificate Identity Mapping Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Certificate Identity Mapping Administrators 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=System: Modify Certmap Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Add Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Delete Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Modify Certmap Rules,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG domain 2024-12-04T14:26:02Z DEBUG pilotObject 2024-12-04T14:26:02Z DEBUG domainRelatedObject 2024-12-04T14:26:02Z DEBUG nisDomainObject 2024-12-04T14:26:02Z DEBUG dc: 2024-12-04T14:26:02Z DEBUG freeipa 2024-12-04T14:26:02Z DEBUG info: 2024-12-04T14:26:02Z DEBUG IPA V2.0 2024-12-04T14:26:02Z DEBUG nisDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG associatedDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)' to aci, current value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)', '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)', '(targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)', '(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)', '(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)', '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)', '(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";)', '(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)', '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";)', '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG domain 2024-12-04T14:26:02Z DEBUG pilotObject 2024-12-04T14:26:02Z DEBUG domainRelatedObject 2024-12-04T14:26:02Z DEBUG nisDomainObject 2024-12-04T14:26:02Z DEBUG dc: 2024-12-04T14:26:02Z DEBUG freeipa 2024-12-04T14:26:02Z DEBUG info: 2024-12-04T14:26:02Z DEBUG IPA V2.0 2024-12-04T14:26:02Z DEBUG nisDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG associatedDomain: 2024-12-04T14:26:02Z DEBUG freeipa.testdomain 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=freeipa,dc=testdomain")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr="altSecurityIdentities")(version 3.0; acl "Authenticated read access to altSecurityIdentities information"; allow(read, search, compare) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash || krbPasswordExpiration")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr="krbPrincipalName || krbCanonicalName")(version 3.0; acl "Admin can write principal names"; allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=freeipa,dc=testdomain" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || membernisnetgroup || modifytimestamp || nisnetgrouptriple || objectclass")(target = "ldap:///cn=ng,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Netgroup Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Preserve User";allow (moddn) groupdn = "ldap:///cn=System: Preserve User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target_to = "ldap:///cn=users,cn=accounts,dc=freeipa,dc=testdomain")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Delete Vaults";allow (delete) groupdn = "ldap:///cn=System: Delete Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "member")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Membership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Membership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Manage Vault Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || ipavaultpublickey || ipavaultsalt || ipavaulttype || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Modify Vaults";allow (write) groupdn = "ldap:///cn=System: Modify Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || ipavaultpublickey || ipavaultsalt || ipavaulttype || member || memberhost || memberuser || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Read Vaults";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vaults,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Add Vault Containers";allow (add) groupdn = "ldap:///cn=System: Add Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Delete Vault Containers";allow (delete) groupdn = "ldap:///cn=System: Delete Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Manage Vault Container Ownership";allow (write) groupdn = "ldap:///cn=System: Manage Vault Container Ownership,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || description || objectclass")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Modify Vault Containers";allow (write) groupdn = "ldap:///cn=System: Modify Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || owner")(target = "ldap:///cn=vaults,cn=kra,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaVaultContainer)")(version 3.0;acl "permission:System: Read Vault Containers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Vault Containers,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata")(targattrfilters="add=objectclass:(objectclass=ipacertmapobject)")(version 3.0;acl "selfservice:Users can manage their own X.509 certificate identity mappings";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/73-certmap.update 0.019 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/73-custodia.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG custodia 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG custodia 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG dogtag 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG dogtag 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/73-custodia.update 0.004 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/73-subid.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG MemberOf Plugin 2024-12-04T14:26:02Z DEBUG memberofattr: 2024-12-04T14:26:02Z DEBUG memberOf 2024-12-04T14:26:02Z DEBUG memberofentryscope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:26:02Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberofgroupattr: 2024-12-04T14:26:02Z DEBUG member 2024-12-04T14:26:02Z DEBUG memberUser 2024-12-04T14:26:02Z DEBUG memberHost 2024-12-04T14:26:02Z DEBUG ipaOwner 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG memberof plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG memberof 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG memberof_postop_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libmemberof-plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG betxnpostoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG 389 Project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG 2.4.6 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG add: 'ipaOwner' to memberofgroupattr, current value ['member', 'memberUser', 'memberHost', 'ipaOwner'] 2024-12-04T14:26:02Z DEBUG add: updated value ['member', 'memberUser', 'memberHost', 'ipaOwner'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=MemberOf Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG MemberOf Plugin 2024-12-04T14:26:02Z DEBUG memberofattr: 2024-12-04T14:26:02Z DEBUG memberOf 2024-12-04T14:26:02Z DEBUG memberofentryscope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberofentryscopeexcludesubtree: 2024-12-04T14:26:02Z DEBUG cn=compat,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberofgroupattr: 2024-12-04T14:26:02Z DEBUG member 2024-12-04T14:26:02Z DEBUG memberUser 2024-12-04T14:26:02Z DEBUG memberHost 2024-12-04T14:26:02Z DEBUG ipaOwner 2024-12-04T14:26:02Z DEBUG nsslapd-plugin-depends-on-type: 2024-12-04T14:26:02Z DEBUG database 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG memberof plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG memberof 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG memberof_postop_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG libmemberof-plugin 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG betxnpostoperation 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG 389 Project 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG 2.4.6 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subids 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subids 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Subordinate ID Selfservice User,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Selfservice User,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice User 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG User that can self-request subordinate ids 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG replace: User that can self-request subordiante ids not found, skipping 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Selfservice User,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice User 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG User that can self-request subordinate ids 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice Users 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice User 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice User,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice Users 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Subordinate ID Selfservice User 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice User,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipapermission 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Self-service subordinate ID 2024-12-04T14:26:02Z DEBUG ipaPermissionType: 2024-12-04T14:26:02Z DEBUG SYSTEM 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipapermission 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Self-service subordinate ID 2024-12-04T14:26:02Z DEBUG ipaPermissionType: 2024-12-04T14:26:02Z DEBUG SYSTEM 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Selfservice Users,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Subordinate ID Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG nestedgroup 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate ID Administrators 2024-12-04T14:26:02Z DEBUG description: 2024-12-04T14:26:02Z DEBUG Subordinate ID Administrators 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=User Administrator,cn=roles,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG memberOf: 2024-12-04T14:26:02Z DEBUG cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipapermission 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Manage subordinate ID 2024-12-04T14:26:02Z DEBUG ipaPermissionType: 2024-12-04T14:26:02Z DEBUG SYSTEM 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Manage subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG groupofnames 2024-12-04T14:26:02Z DEBUG ipapermission 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Manage subordinate ID 2024-12-04T14:26:02Z DEBUG ipaPermissionType: 2024-12-04T14:26:02Z DEBUG SYSTEM 2024-12-04T14:26:02Z DEBUG member: 2024-12-04T14:26:02Z DEBUG cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subids 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=subids,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subids 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=freeipa,dc=testdomain")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(ipasubuidnumber=-1) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(ipasubgidnumber=-1) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "selfservice: Add subordinate id";allow (add, write) userattr = "ipaowner#SELFDN" and groupdn="ldap:///cn=Self-service subordinate ID,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=ipasubordinateidentry)")(targetattr="description || ipaowner || ipauniqueid")(targattrfilters = "add=objectClass:(|(objectClass=top)(objectClass=ipasubordinateid)(objectClass=ipasubordinateidentry)(objectClass=ipasubordinategid)(objectClass=ipasubordinateuid)) && ipasubuidnumber:(|(ipasubuidnumber>=1)(ipasubuidnumber=-1)) && ipasubuidcount:(ipasubuidcount=65536) && ipasubgidnumber:(|(ipasubgidnumber>=1)(ipasubgidnumber=-1)) && ipasubgidcount:(ipasubgidcount=65536), del=ipasubuidnumber:(!(ipasubuidnumber=*)) && ipasubuidcount:(!(ipasubuidcount=*)) && ipasubgidnumber:(!(ipasubgidnumber=*)) && ipasubgidcount:(!(ipasubgidcount=*))")(version 3.0;acl "Add subordinate ids to any user";allow (add, write) groupdn="ldap:///cn=Subordinate ID Administrators,cn=privileges,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subordinate-ids 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG subordinate-ids 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Subordinate IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate IDs 2024-12-04T14:26:02Z DEBUG dnaExcludeScope: 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaFilter: 2024-12-04T14:26:02Z DEBUG (objectClass=ipaSubordinateId) 2024-12-04T14:26:02Z DEBUG dnaInterval: 2024-12-04T14:26:02Z DEBUG 65536 2024-12-04T14:26:02Z DEBUG dnaMagicRegen: 2024-12-04T14:26:02Z DEBUG -1 2024-12-04T14:26:02Z DEBUG dnaMaxValue: 2024-12-04T14:26:02Z DEBUG 4294836224 2024-12-04T14:26:02Z DEBUG dnaNextValue: 2024-12-04T14:26:02Z DEBUG 2147483648 2024-12-04T14:26:02Z DEBUG dnaScope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:02Z DEBUG cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaThreshold: 2024-12-04T14:26:02Z DEBUG 500 2024-12-04T14:26:02Z DEBUG dnaType: 2024-12-04T14:26:02Z DEBUG ipasubuidnumber 2024-12-04T14:26:02Z DEBUG ipasubgidnumber 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Subordinate IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Subordinate IDs 2024-12-04T14:26:02Z DEBUG dnaExcludeScope: 2024-12-04T14:26:02Z DEBUG cn=provisioning,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaFilter: 2024-12-04T14:26:02Z DEBUG (objectClass=ipaSubordinateId) 2024-12-04T14:26:02Z DEBUG dnaInterval: 2024-12-04T14:26:02Z DEBUG 65536 2024-12-04T14:26:02Z DEBUG dnaMagicRegen: 2024-12-04T14:26:02Z DEBUG -1 2024-12-04T14:26:02Z DEBUG dnaMaxValue: 2024-12-04T14:26:02Z DEBUG 4294836224 2024-12-04T14:26:02Z DEBUG dnaNextValue: 2024-12-04T14:26:02Z DEBUG 2147483648 2024-12-04T14:26:02Z DEBUG dnaScope: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaSharedCfgDN: 2024-12-04T14:26:02Z DEBUG cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG dnaThreshold: 2024-12-04T14:26:02Z DEBUG 500 2024-12-04T14:26:02Z DEBUG dnaType: 2024-12-04T14:26:02Z DEBUG ipasubuidnumber 2024-12-04T14:26:02Z DEBUG ipasubgidnumber 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "dnaNextRange || dnaNextValue || dnaMaxValue")(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass")(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=FREEIPA.TESTDOMAIN_subid_range,cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=FREEIPA.TESTDOMAIN_subid_range,cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaIDrange 2024-12-04T14:26:02Z DEBUG ipaTrustedADDomainRange 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG FREEIPA.TESTDOMAIN_subid_range 2024-12-04T14:26:02Z DEBUG ipaBaseID: 2024-12-04T14:26:02Z DEBUG 2147483648 2024-12-04T14:26:02Z DEBUG ipaIDRangeSize: 2024-12-04T14:26:02Z DEBUG 2147352576 2024-12-04T14:26:02Z DEBUG ipaBaseRID: 2024-12-04T14:26:02Z DEBUG 2147043648 2024-12-04T14:26:02Z DEBUG ipaNTTrustedDomainSID: 2024-12-04T14:26:02Z DEBUG S-1-5-21-738065-838566-958396748 2024-12-04T14:26:02Z DEBUG ipaRangeType: 2024-12-04T14:26:02Z DEBUG ipa-ad-trust 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=FREEIPA.TESTDOMAIN_subid_range,cn=ranges,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG ipaIDrange 2024-12-04T14:26:02Z DEBUG ipaTrustedADDomainRange 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG FREEIPA.TESTDOMAIN_subid_range 2024-12-04T14:26:02Z DEBUG ipaBaseID: 2024-12-04T14:26:02Z DEBUG 2147483648 2024-12-04T14:26:02Z DEBUG ipaIDRangeSize: 2024-12-04T14:26:02Z DEBUG 2147352576 2024-12-04T14:26:02Z DEBUG ipaBaseRID: 2024-12-04T14:26:02Z DEBUG 2147043648 2024-12-04T14:26:02Z DEBUG ipaNTTrustedDomainSID: 2024-12-04T14:26:02Z DEBUG S-1-5-21-738065-838566-958396748 2024-12-04T14:26:02Z DEBUG ipaRangeType: 2024-12-04T14:26:02Z DEBUG ipa-ad-trust 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/73-subid.update 0.031 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/73-winsync.update' 2024-12-04T14:26:02Z DEBUG New entry: uid=passsync,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: uid=passsync,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG addifexist: 'inetUser' to objectClass, current value [] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: uid=passsync,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/73-winsync.update 0.001 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/75-user-trust-attributes.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)' to aci, current value ['(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";)', '(targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";)', '(targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";)' to aci, current value ['(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";)', '(targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";)', '(targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";)', '(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";)', '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";)', '(targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";)'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=accounts,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsContainer 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "uid")(target = "ldap:///uid=*,cn=users,cn=accounts,dc=freeipa,dc=testdomain")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify User RDN";allow (write) groupdn = "ldap:///cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastadminunlock || krblastfailedauth || krblastpwdchange || krblastsuccessfulauth || krbloginfailedcount || krbpwdpolicyreference || krbticketpolicyreference || krbupenabled")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Login Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "memberof")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Membership";allow (compare,read,search) userdn = "ldap:///all";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ntuniqueid || ntuseracctexpires || ntusercodepage || ntuserdeleteaccount || ntuserdomainid || ntuserlastlogoff || ntuserlastlogon")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User NT Attributes";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User NT Attributes,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "cn || createtimestamp || description || displayname || entryusn || gecos || gidnumber || givenname || homedirectory || initials || ipantsecurityidentifier || loginshell || manager || modifytimestamp || objectclass || sn || title || uid || uidnumber")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Standard Attributes";allow (compare,read,search) userdn = "ldap:///anyone";) 2024-12-04T14:26:02Z DEBUG (targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=freeipa,dc=testdomain))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "system:Allow trust agents to read user SMB attributes";allow (read) groupdn = "ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain";) 2024-12-04T14:26:02Z DEBUG (targetattr = "ipantlogonscript || ipantprofilepath || ipanthomedirectory || ipanthomedirectorydrive")(version 3.0;acl "selfservice:Users can manage their SMB attributes";allow (write) userdn = "ldap:///self";) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/75-user-trust-attributes.update 0.005 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/80-schema_compat.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Schema Compatibility 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG off 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG schema_compat_plugin_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG object 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:02Z DEBUG 40 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Schema Compatibility 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG off 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG schema_compat_plugin_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG object 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:02Z DEBUG 40 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ng 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-check-access: 2024-12-04T14:26:02Z DEBUG yes 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=ng 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=nisNetgroup 2024-12-04T14:26:02Z DEBUG memberNisNetgroup=%deref_r("member","cn") 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=ng, cn=alt, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (objectclass=ipaNisNetgroup) 2024-12-04T14:26:02Z DEBUG add: 'top' to objectClass, current value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: updated value ['extensibleObject', 'top'] 2024-12-04T14:26:02Z DEBUG add: 'extensibleObject' to objectClass, current value ['extensibleObject', 'top'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: 'ng' to cn, current value ['ng'] 2024-12-04T14:26:02Z DEBUG add: updated value ['ng'] 2024-12-04T14:26:02Z DEBUG add: 'cn=compat, dc=freeipa,dc=testdomain' to schema-compat-container-group, current value ['cn=compat, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=compat, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=ng' to schema-compat-container-rdn, current value ['cn=ng'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=ng'] 2024-12-04T14:26:02Z DEBUG add: 'yes' to schema-compat-check-access, current value ['yes'] 2024-12-04T14:26:02Z DEBUG add: updated value ['yes'] 2024-12-04T14:26:02Z DEBUG add: 'cn=ng, cn=alt, dc=freeipa,dc=testdomain' to schema-compat-search-base, current value ['cn=ng, cn=alt, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=ng, cn=alt, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: '(objectclass=ipaNisNetgroup)' to schema-compat-search-filter, current value ['(objectclass=ipaNisNetgroup)'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(objectclass=ipaNisNetgroup)'] 2024-12-04T14:26:02Z DEBUG add: 'cn=%{cn}' to schema-compat-entry-rdn, current value ['cn=%{cn}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=%{cn}'] 2024-12-04T14:26:02Z DEBUG add: 'objectclass=nisNetgroup' to schema-compat-entry-attribute, current value ['objectclass=nisNetgroup', 'memberNisNetgroup=%deref_r("member","cn")', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})'] 2024-12-04T14:26:02Z DEBUG add: updated value ['memberNisNetgroup=%deref_r("member","cn")', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'objectclass=nisNetgroup'] 2024-12-04T14:26:02Z DEBUG add: 'memberNisNetgroup=%deref_r("member","cn")' to schema-compat-entry-attribute, current value ['memberNisNetgroup=%deref_r("member","cn")', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'objectclass=nisNetgroup'] 2024-12-04T14:26:02Z DEBUG add: updated value ['nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'objectclass=nisNetgroup', 'memberNisNetgroup=%deref_r("member","cn")'] 2024-12-04T14:26:02Z DEBUG add: 'nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","-",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","-"),%{nisDomainName:-})' to schema-compat-entry-attribute, current value ['nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'objectclass=nisNetgroup', 'memberNisNetgroup=%deref_r("member","cn")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'objectclass=nisNetgroup', 'memberNisNetgroup=%deref_r("member","cn")', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","-",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","-"),%{nisDomainName:-})'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ng 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-check-access: 2024-12-04T14:26:02Z DEBUG yes 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=ng 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG objectclass=nisNetgroup 2024-12-04T14:26:02Z DEBUG memberNisNetgroup=%deref_r("member","cn") 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","-",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","-"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=ng, cn=alt, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (objectclass=ipaNisNetgroup) 2024-12-04T14:26:02Z DEBUG [(0, 'schema-compat-entry-attribute', ['nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","-",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","-"),%{nisDomainName:-})'])] 2024-12-04T14:26:02Z DEBUG Updated 1 2024-12-04T14:26:02Z DEBUG update_entry modlist [(0, 'schema-compat-entry-attribute', [b'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","-",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","-"),%{nisDomainName:-})'])] 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG add: 'top' to objectClass, current value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: updated value ['extensibleObject', 'top'] 2024-12-04T14:26:02Z DEBUG add: 'extensibleObject' to objectClass, current value ['extensibleObject', 'top'] 2024-12-04T14:26:02Z DEBUG add: updated value ['top', 'extensibleObject'] 2024-12-04T14:26:02Z DEBUG add: 'sudoers' to cn, current value ['sudoers'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoers'] 2024-12-04T14:26:02Z DEBUG add: 'ou=SUDOers, dc=freeipa,dc=testdomain' to schema-compat-container-group, current value ['ou=SUDOers, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['ou=SUDOers, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain' to schema-compat-search-base, current value ['cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: '(&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE)))' to schema-compat-search-filter, current value ['(&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE)))'] 2024-12-04T14:26:02Z DEBUG add: updated value ['(&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE)))'] 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")' to schema-compat-entry-rdn, current value ['%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'] 2024-12-04T14:26:02Z DEBUG add: 'objectclass=sudoRole' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole'] 2024-12-04T14:26:02Z DEBUG add: 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")' to schema-compat-entry-attribute, current value ['sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")")' to schema-compat-entry-attribute, current value ['sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")")' to schema-compat-entry-attribute, current value ['sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")' to schema-compat-entry-attribute, current value ['sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")")' to schema-compat-entry-attribute, current value ['sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")")' to schema-compat-entry-attribute, current value ['sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")' to schema-compat-entry-attribute, current value ['sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")' to schema-compat-entry-attribute, current value ['sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")' to schema-compat-entry-attribute, current value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")' to schema-compat-entry-attribute, current value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")")' to schema-compat-entry-attribute, current value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")' to schema-compat-entry-attribute, current value ['sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoOption=%{ipaSudoOpt}' to schema-compat-entry-attribute, current value ['sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG computers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=computers 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=device 2024-12-04T14:26:02Z DEBUG objectclass=ieee802Device 2024-12-04T14:26:02Z DEBUG cn=%{fqdn} 2024-12-04T14:26:02Z DEBUG macAddress=%{macAddress} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%first("%{fqdn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=computers, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(macAddress=*)(fqdn=*)(objectClass=ipaHost)) 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG computers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=computers 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=device 2024-12-04T14:26:02Z DEBUG objectclass=ieee802Device 2024-12-04T14:26:02Z DEBUG cn=%{fqdn} 2024-12-04T14:26:02Z DEBUG macAddress=%{macAddress} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%first("%{fqdn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=computers, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(macAddress=*)(fqdn=*)(objectClass=ipaHost)) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG VLV Request Control 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG directoryServerFeature 2024-12-04T14:26:02Z DEBUG oid: 2024-12-04T14:26:02Z DEBUG 2.16.840.1.113730.3.4.9 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (read, search, compare, proxy) userdn = "ldap:///anyone"; ) 2024-12-04T14:26:02Z DEBUG only: set aci to '(targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (read, search, compare, proxy) userdn = "ldap:///anyone"; )', current value ['(targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (read, search, compare, proxy) userdn = "ldap:///anyone"; )'] 2024-12-04T14:26:02Z DEBUG only: updated value ['(targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (read, search, compare, proxy) userdn = "ldap:///anyone"; )'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG VLV Request Control 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG directoryServerFeature 2024-12-04T14:26:02Z DEBUG oid: 2024-12-04T14:26:02Z DEBUG 2.16.840.1.113730.3.4.9 2024-12-04T14:26:02Z DEBUG aci: 2024-12-04T14:26:02Z DEBUG (targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (read, search, compare, proxy) userdn = "ldap:///anyone"; ) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG only: set schema-compat-entry-rdn to '%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")', current value ['%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'] 2024-12-04T14:26:02Z DEBUG only: updated value ['%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")' not in schema-compat-entry-attribute 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsUser=%{ipaSudoRunAsExtUser}' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsUser=%{ipaSudoRunAsExtUser}' not in schema-compat-entry-attribute 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'] 2024-12-04T14:26:02Z DEBUG remove: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsUser=%deref("ipaSudoRunAs","uid")' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsUser=%deref("ipaSudoRunAs","uid")' not in schema-compat-entry-attribute 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsGroup=%{ipaSudoRunAsExtGroup}' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsGroup=%{ipaSudoRunAsExtGroup}' not in schema-compat-entry-attribute 2024-12-04T14:26:02Z DEBUG remove: 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")' from schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG remove: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG [(1, 'schema-compat-entry-attribute', ['sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'])] 2024-12-04T14:26:02Z DEBUG Updated 1 2024-12-04T14:26:02Z DEBUG update_entry modlist [(1, 'schema-compat-entry-attribute', [b'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'])] 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'] 2024-12-04T14:26:02Z DEBUG add: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")")' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG add: 'dc=freeipa,dc=testdomain' to schema-compat-restrict-subtree, current value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Schema Compatibility,cn=plugins,cn=config' to schema-compat-restrict-subtree, current value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG [(0, 'schema-compat-entry-attribute', ['sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'])] 2024-12-04T14:26:02Z DEBUG Updated 1 2024-12-04T14:26:02Z DEBUG update_entry modlist [(0, 'schema-compat-entry-attribute', [b'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'])] 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ng 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-check-access: 2024-12-04T14:26:02Z DEBUG yes 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=ng 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=nisNetgroup 2024-12-04T14:26:02Z DEBUG memberNisNetgroup=%deref_r("member","cn") 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","-",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","-"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=ng, cn=alt, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (objectclass=ipaNisNetgroup) 2024-12-04T14:26:02Z DEBUG replace: updated value ['objectclass=nisNetgroup', 'memberNisNetgroup=%deref_r("member","cn")', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})', 'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"-\\")",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"-\\")"),%{nisDomainName:-})'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG add: 'dc=freeipa,dc=testdomain' to schema-compat-restrict-subtree, current value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Schema Compatibility,cn=plugins,cn=config' to schema-compat-restrict-subtree, current value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG ng 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-check-access: 2024-12-04T14:26:02Z DEBUG yes 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=ng 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=nisNetgroup 2024-12-04T14:26:02Z DEBUG memberNisNetgroup=%deref_r("member","cn") 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-}) 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=ng, cn=alt, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (objectclass=ipaNisNetgroup) 2024-12-04T14:26:02Z DEBUG [(1, 'schema-compat-entry-attribute', ['nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","-",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","-"),%{nisDomainName:-})'])] 2024-12-04T14:26:02Z DEBUG Updated 1 2024-12-04T14:26:02Z DEBUG update_entry modlist [(1, 'schema-compat-entry-attribute', [b'nisNetgroupTriple=(%link("%ifeq(\\"hostCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%{externalHost}\\\\\\",\\\\\\"%deref(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberHost\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"fqdn\\\\\\\\\\\\\\")\\\\\\")\\")","-",",","%ifeq(\\"userCategory\\",\\"all\\",\\"\\",\\"%collect(\\\\\\"%deref(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\",\\\\\\"%deref_r(\\\\\\\\\\\\\\"memberUser\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"member\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"uid\\\\\\\\\\\\\\")\\\\\\")\\")","-"),%{nisDomainName:-})'])] 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG computers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=computers 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=device 2024-12-04T14:26:02Z DEBUG objectclass=ieee802Device 2024-12-04T14:26:02Z DEBUG cn=%{fqdn} 2024-12-04T14:26:02Z DEBUG macAddress=%{macAddress} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%first("%{fqdn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=computers, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(macAddress=*)(fqdn=*)(objectClass=ipaHost)) 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG add: 'dc=freeipa,dc=testdomain' to schema-compat-restrict-subtree, current value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Schema Compatibility,cn=plugins,cn=config' to schema-compat-restrict-subtree, current value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG computers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=computers 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=device 2024-12-04T14:26:02Z DEBUG objectclass=ieee802Device 2024-12-04T14:26:02Z DEBUG cn=%{fqdn} 2024-12-04T14:26:02Z DEBUG macAddress=%{macAddress} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%first("%{fqdn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=computers, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(macAddress=*)(fqdn=*)(objectClass=ipaHost)) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG add: 'sudoOrder=%{sudoOrder}' to schema-compat-entry-attribute, current value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoOrder=%{sudoOrder}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=sudoRole', 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\\"memberUser\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\\"memberUser\\",\\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\\",\\"member\\",\\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\\",\\"uid\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\\"memberUser\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\\"memberUser\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\\"memberHost\\",\\"(objectclass=ipaHost)\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\\",\\"member\\",\\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\\",\\"fqdn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\\"memberHost\\",\\"(objectclass=ipaNisNetgroup)\\",\\"cn\\")")', 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\\"memberAllowCmd\\",\\"sudoCmd\\")")', 'sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\\"memberAllowCmd\\",\\"member\\",\\"sudoCmd\\")")', 'sudoCommand=!%deref("memberDenyCmd","sudoCmd")', 'sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixAccount)\\",\\"uid\\")")', 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\\"ipaSudoRunAs\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")', 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\\"ipaSudoRunAsGroup\\",\\"(objectclass=posixGroup)\\",\\"cn\\")")', 'sudoOption=%{ipaSudoOpt}', 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")', 'sudoOrder=%{sudoOrder}'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG sudoers 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG ou=SUDOers, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=sudoRole 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%deref_rf(\"memberUser\",\"(&(objectclass=ipaUserGroup)(!(objectclass=posixGroup)))\",\"member\",\"(|(objectclass=ipaUserGroup)(objectclass=posixAccount))\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","%%%deref_f(\"memberUser\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoUser=%ifeq("userCategory","all","ALL","+%deref_f(\"memberUser\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{externalHost}") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_f(\"memberHost\",\"(objectclass=ipaHost)\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%deref_rf(\"memberHost\",\"(&(objectclass=ipaHostGroup)(!(objectclass=mepOriginEntry)))\",\"member\",\"(|(objectclass=ipaHostGroup)(objectclass=ipaHost))\",\"fqdn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(&(objectclass=ipaHostGroup)(objectclass=mepOriginEntry))\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","+%deref_f(\"memberHost\",\"(objectclass=ipaNisNetgroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref(\"memberAllowCmd\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=%ifeq("cmdCategory","all","ALL","%deref_r(\"memberAllowCmd\",\"member\",\"sudoCmd\")") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref("memberDenyCmd","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoCommand=!%deref_r("memberDenyCmd","member","sudoCmd") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}") 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")") 2024-12-04T14:26:02Z DEBUG sudoOption=%{ipaSudoOpt} 2024-12-04T14:26:02Z DEBUG sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn") 2024-12-04T14:26:02Z DEBUG sudoOrder=%{sudoOrder} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=sudorules, cn=sudo, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG add: 'dc=freeipa,dc=testdomain' to schema-compat-restrict-subtree, current value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Schema Compatibility,cn=plugins,cn=config' to schema-compat-restrict-subtree, current value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'cn=changelog' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' from schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG remove: 'o=ipaca' not in schema-compat-ignore-subtree 2024-12-04T14:26:02Z DEBUG add: 'dc=freeipa,dc=testdomain' to schema-compat-restrict-subtree, current value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=Schema Compatibility,cn=plugins,cn=config' to schema-compat-restrict-subtree, current value ['cn=Schema Compatibility,cn=plugins,cn=config', 'dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'cn=Schema Compatibility,cn=plugins,cn=config'] 2024-12-04T14:26:02Z DEBUG add: 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain' to schema-compat-ignore-subtree, current value ['cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG add: updated value ['cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain', 'cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Schema Compatibility 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG off 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG schema_compat_plugin_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG object 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:02Z DEBUG 40 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG add: '40' to nsslapd-pluginprecedence, current value ['40'] 2024-12-04T14:26:02Z DEBUG add: updated value ['40'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG Schema Compatibility 2024-12-04T14:26:02Z DEBUG nsslapd-pluginDescription: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginEnabled: 2024-12-04T14:26:02Z DEBUG off 2024-12-04T14:26:02Z DEBUG nsslapd-pluginId: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginInitfunc: 2024-12-04T14:26:02Z DEBUG schema_compat_plugin_init 2024-12-04T14:26:02Z DEBUG nsslapd-pluginPath: 2024-12-04T14:26:02Z DEBUG /usr/lib64/dirsrv/plugins/schemacompat-plugin.so 2024-12-04T14:26:02Z DEBUG nsslapd-pluginType: 2024-12-04T14:26:02Z DEBUG object 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVendor: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginVersion: 2024-12-04T14:26:02Z DEBUG none 2024-12-04T14:26:02Z DEBUG nsslapd-pluginbetxn: 2024-12-04T14:26:02Z DEBUG on 2024-12-04T14:26:02Z DEBUG nsslapd-pluginprecedence: 2024-12-04T14:26:02Z DEBUG 40 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG nsSlapdPlugin 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")' to schema-compat-entry-attribute, current value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")' to schema-compat-entry-attribute, current value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")'] 2024-12-04T14:26:02Z DEBUG add: 'ipaanchoruuid=%{ipaanchoruuid}' to schema-compat-entry-attribute, current value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}'] 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")' to schema-compat-entry-attribute, current value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', 'uid=%{uid}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")'] 2024-12-04T14:26:02Z DEBUG add: 'ipaanchoruuid=%{ipaanchoruuid}' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}'] 2024-12-04T14:26:02Z DEBUG add: '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG add: 'uid=%{uid}' to schema-compat-entry-attribute, current value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}'] 2024-12-04T14:26:02Z DEBUG add: updated value ['objectclass=posixAccount', 'gecos=%{cn}', 'cn=%{cn}', 'uidNumber=%{uidNumber}', 'gidNumber=%{gidNumber}', 'loginShell=%{loginShell}', 'homeDirectory=%{homeDirectory}', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'uid=%{uid}'] 2024-12-04T14:26:02Z DEBUG replace: uid=%{uid} not found, skipping 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG users 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=users 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG gecos=%{cn} 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG uidNumber=%{uidNumber} 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG loginShell=%{loginShell} 2024-12-04T14:26:02Z DEBUG homeDirectory=%{homeDirectory} 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG uid=%{uid} 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG uid=%first("%{uid}") 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG user 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=users, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixAccount 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/80-schema_compat.update 0.412 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/81-externalmembers.update' 2024-12-04T14:26:02Z DEBUG Updating existing entry: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Initial value 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG addifexist: 'ipaexternalmember=%deref_r("member","ipaexternalmember")' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup'] 2024-12-04T14:26:02Z DEBUG addifexist: set schema-compat-entry-attribute to ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', 'ipaexternalmember=%deref_r("member","ipaexternalmember")'] 2024-12-04T14:26:02Z DEBUG addifexist: 'objectclass=ipaexternalgroup' to schema-compat-entry-attribute, current value ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', 'ipaexternalmember=%deref_r("member","ipaexternalmember")'] 2024-12-04T14:26:02Z DEBUG addifexist: set schema-compat-entry-attribute to ['objectclass=posixGroup', 'gidNumber=%{gidNumber}', 'memberUid=%{memberUid}', 'memberUid=%deref_r("member","uid")', '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")', '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","")', 'ipaanchoruuid=%{ipaanchoruuid}', '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup', 'ipaexternalmember=%deref_r("member","ipaexternalmember")', 'objectclass=ipaexternalgroup'] 2024-12-04T14:26:02Z DEBUG --------------------------------------------- 2024-12-04T14:26:02Z DEBUG Final value after applying updates 2024-12-04T14:26:02Z DEBUG dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG cn: 2024-12-04T14:26:02Z DEBUG groups 2024-12-04T14:26:02Z DEBUG objectClass: 2024-12-04T14:26:02Z DEBUG top 2024-12-04T14:26:02Z DEBUG extensibleObject 2024-12-04T14:26:02Z DEBUG schema-compat-container-group: 2024-12-04T14:26:02Z DEBUG cn=compat, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-container-rdn: 2024-12-04T14:26:02Z DEBUG cn=groups 2024-12-04T14:26:02Z DEBUG schema-compat-entry-attribute: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG gidNumber=%{gidNumber} 2024-12-04T14:26:02Z DEBUG memberUid=%{memberUid} 2024-12-04T14:26:02Z DEBUG memberUid=%deref_r("member","uid") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:freeipa.testdomain:%{ipauniqueid}","") 2024-12-04T14:26:02Z DEBUG ipaanchoruuid=%{ipaanchoruuid} 2024-12-04T14:26:02Z DEBUG %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","") 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG ipaexternalmember=%deref_r("member","ipaexternalmember") 2024-12-04T14:26:02Z DEBUG objectclass=ipaexternalgroup 2024-12-04T14:26:02Z DEBUG schema-compat-entry-rdn: 2024-12-04T14:26:02Z DEBUG cn=%{cn} 2024-12-04T14:26:02Z DEBUG schema-compat-ignore-subtree: 2024-12-04T14:26:02Z DEBUG cn=dna,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-lookup-nsswitch: 2024-12-04T14:26:02Z DEBUG group 2024-12-04T14:26:02Z DEBUG schema-compat-restrict-subtree: 2024-12-04T14:26:02Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG cn=Schema Compatibility,cn=plugins,cn=config 2024-12-04T14:26:02Z DEBUG schema-compat-search-base: 2024-12-04T14:26:02Z DEBUG cn=groups, cn=accounts, dc=freeipa,dc=testdomain 2024-12-04T14:26:02Z DEBUG schema-compat-search-filter: 2024-12-04T14:26:02Z DEBUG objectclass=posixGroup 2024-12-04T14:26:02Z DEBUG [] 2024-12-04T14:26:02Z DEBUG Updated 0 2024-12-04T14:26:02Z DEBUG Done 2024-12-04T14:26:02Z DEBUG LDAP update duration: /usr/share/ipa/updates/81-externalmembers.update 0.005 sec 2024-12-04T14:26:02Z DEBUG Parsing update file '/usr/share/ipa/updates/90-post_upgrade_plugins.update' 2024-12-04T14:26:02Z DEBUG Executing upgrade plugin: update_ca_topology 2024-12-04T14:26:02Z DEBUG raw: update_ca_topology 2024-12-04T14:26:02Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:02Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2024-12-04T14:26:02Z DEBUG importing all plugin modules in ipaserver.plugins... 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.aci 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.automember 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.automount 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.baseldap 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.baseuser 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.batch 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.ca 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.caacl 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.cert 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.certmap 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.certprofile 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.config 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.delegation 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.dns 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.dnsserver 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.dogtag 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.domainlevel 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.group 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hbac 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.hbac is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hbacrule 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hbacsvc 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hbactest 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.host 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.hostgroup 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.idp 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.idrange 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.idviews 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.internal 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.join 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.ldap2 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.location 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.migration 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.misc 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.netgroup 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.otp 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.otp is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.otpconfig 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.otptoken 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.passwd 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.permission 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.ping 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.pkinit 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.privilege 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.pwpolicy 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.rabase 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.rabase is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.radiusproxy 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.realmdomains 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.role 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.schema 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.selfservice 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.server 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.serverrole 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.serverroles 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.service 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.servicedelegation 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.session 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.stageuser 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.subid 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.sudo 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.sudo is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.sudocmd 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.sudorule 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.topology 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.trust 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.user 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.vault 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.virtual 2024-12-04T14:26:02Z DEBUG ipaserver.plugins.virtual is not a valid plugin module 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.whoami 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.plugins.xmlserver 2024-12-04T14:26:02Z DEBUG importing all plugin modules in ipaserver.install.plugins... 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.adtrust 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.dns 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.fix_kra_people_entry 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_changelog_maxage 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_nis 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_pwpolicy 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_referint 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_services 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_unhashed_password 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness 2024-12-04T14:26:02Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt 2024-12-04T14:26:03Z DEBUG Created connection context.ldap2_140061365176640 2024-12-04T14:26:03Z DEBUG raw: idrange_show('FREEIPA.TESTDOMAIN_id_range', version='2.251') 2024-12-04T14:26:03Z DEBUG idrange_show('FREEIPA.TESTDOMAIN_id_range', rights=False, all=False, raw=False, version='2.251') 2024-12-04T14:26:03Z DEBUG flushing ldapi://%2Frun%2Fslapd-FREEIPA-TESTDOMAIN.socket from SchemaCache 2024-12-04T14:26:03Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Frun%2Fslapd-FREEIPA-TESTDOMAIN.socket conn= 2024-12-04T14:26:03Z DEBUG Parsing update file '/usr/share/ipa/ca-topology.uldif' 2024-12-04T14:26:03Z DEBUG Updating existing entry: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Initial value 2024-12-04T14:26:03Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG objectClass: 2024-12-04T14:26:03Z DEBUG top 2024-12-04T14:26:03Z DEBUG nsContainer 2024-12-04T14:26:03Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:26:03Z DEBUG ipaConfigObject 2024-12-04T14:26:03Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:26:03Z DEBUG cn: 2024-12-04T14:26:03Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:03Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:26:03Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG o=ipaca 2024-12-04T14:26:03Z DEBUG ipaMinDomainLevel: 2024-12-04T14:26:03Z DEBUG 1 2024-12-04T14:26:03Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:26:03Z DEBUG 1 2024-12-04T14:26:03Z DEBUG add: 'ipaReplTopoManagedServer' to objectclass, current value ['top', 'nsContainer', 'ipaReplTopoManagedServer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig'] 2024-12-04T14:26:03Z DEBUG add: updated value ['top', 'nsContainer', 'ipaConfigObject', 'ipaSupportedDomainLevelConfig', 'ipaReplTopoManagedServer'] 2024-12-04T14:26:03Z DEBUG add: 'o=ipaca' to ipaReplTopoManagedSuffix, current value ['dc=freeipa,dc=testdomain', 'o=ipaca'] 2024-12-04T14:26:03Z DEBUG add: updated value ['dc=freeipa,dc=testdomain', 'o=ipaca'] 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Final value after applying updates 2024-12-04T14:26:03Z DEBUG dn: cn=dc.freeipa.testdomain,cn=masters,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG objectClass: 2024-12-04T14:26:03Z DEBUG top 2024-12-04T14:26:03Z DEBUG nsContainer 2024-12-04T14:26:03Z DEBUG ipaConfigObject 2024-12-04T14:26:03Z DEBUG ipaSupportedDomainLevelConfig 2024-12-04T14:26:03Z DEBUG ipaReplTopoManagedServer 2024-12-04T14:26:03Z DEBUG cn: 2024-12-04T14:26:03Z DEBUG dc.freeipa.testdomain 2024-12-04T14:26:03Z DEBUG ipaReplTopoManagedSuffix: 2024-12-04T14:26:03Z DEBUG dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG o=ipaca 2024-12-04T14:26:03Z DEBUG ipaMinDomainLevel: 2024-12-04T14:26:03Z DEBUG 1 2024-12-04T14:26:03Z DEBUG ipaMaxDomainLevel: 2024-12-04T14:26:03Z DEBUG 1 2024-12-04T14:26:03Z DEBUG [] 2024-12-04T14:26:03Z DEBUG Updated 0 2024-12-04T14:26:03Z DEBUG Done 2024-12-04T14:26:03Z DEBUG Updating existing entry: cn=ca,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Initial value 2024-12-04T14:26:03Z DEBUG dn: cn=ca,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG objectClass: 2024-12-04T14:26:03Z DEBUG top 2024-12-04T14:26:03Z DEBUG iparepltopoconf 2024-12-04T14:26:03Z DEBUG ipaReplTopoConfRoot: 2024-12-04T14:26:03Z DEBUG o=ipaca 2024-12-04T14:26:03Z DEBUG cn: 2024-12-04T14:26:03Z DEBUG ca 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Final value after applying updates 2024-12-04T14:26:03Z DEBUG dn: cn=ca,cn=topology,cn=ipa,cn=etc,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG objectClass: 2024-12-04T14:26:03Z DEBUG top 2024-12-04T14:26:03Z DEBUG iparepltopoconf 2024-12-04T14:26:03Z DEBUG ipaReplTopoConfRoot: 2024-12-04T14:26:03Z DEBUG o=ipaca 2024-12-04T14:26:03Z DEBUG cn: 2024-12-04T14:26:03Z DEBUG ca 2024-12-04T14:26:03Z DEBUG [] 2024-12-04T14:26:03Z DEBUG Updated 0 2024-12-04T14:26:03Z DEBUG Done 2024-12-04T14:26:03Z DEBUG New entry: cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Initial value 2024-12-04T14:26:03Z DEBUG dn: cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:26:03Z DEBUG onlyifexist: 'cn=replication managers,cn=sysaccounts,cn=etc,dc=freeipa,dc=testdomain' to nsds5replicabinddngroup, current value [] 2024-12-04T14:26:03Z DEBUG --------------------------------------------- 2024-12-04T14:26:03Z DEBUG Final value after applying updates 2024-12-04T14:26:03Z DEBUG dn: cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config 2024-12-04T14:26:03Z DEBUG LDAP update duration: /usr/share/ipa/ca-topology.uldif 0.005 sec 2024-12-04T14:26:03Z DEBUG Destroyed connection context.ldap2_140061365176640 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_ipaconfigstring_dnsversion_to_ipadnsversion 2024-12-04T14:26:03Z DEBUG raw: update_ipaconfigstring_dnsversion_to_ipadnsversion 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_dnszones 2024-12-04T14:26:03Z DEBUG raw: update_dnszones 2024-12-04T14:26:03Z DEBUG raw: dnszone_find(None, all=True, version='2.251') 2024-12-04T14:26:03Z DEBUG dnszone_find(None, forward_only=False, all=True, raw=False, version='2.251', pkey_only=False) 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_dns_limits 2024-12-04T14:26:03Z DEBUG raw: update_dns_limits 2024-12-04T14:26:03Z DEBUG DNS: limits for service krbprincipalname=DNS/dc.freeipa.testdomain@FREEIPA.TESTDOMAIN,cn=services,cn=accounts,dc=freeipa,dc=testdomain already set 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_sigden_extdom_broken_config 2024-12-04T14:26:03Z DEBUG raw: update_sigden_extdom_broken_config 2024-12-04T14:26:03Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:26:03Z DEBUG Already done, skipping 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_sids 2024-12-04T14:26:03Z DEBUG raw: update_sids 2024-12-04T14:26:03Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2024-12-04T14:26:03Z DEBUG SIDs do not need to be generated 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_default_range 2024-12-04T14:26:03Z DEBUG raw: update_default_range 2024-12-04T14:26:03Z DEBUG default_range: ipaDomainIDRange entry found, skip plugin 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_default_trust_view 2024-12-04T14:26:03Z DEBUG raw: update_default_trust_view 2024-12-04T14:26:03Z DEBUG raw: adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG Default Trust View already present on this server 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_tdo_gidnumber 2024-12-04T14:26:03Z DEBUG raw: update_tdo_gidnumber 2024-12-04T14:26:03Z DEBUG raw: adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG update_entry modlist [(2, 'homedirectory', [b'/dev/null']), (2, 'uid', [b'TRUSTD$'])] 2024-12-04T14:26:03Z DEBUG Executing upgrade plugin: update_tdo_to_new_layout 2024-12-04T14:26:03Z DEBUG raw: update_tdo_to_new_layout 2024-12-04T14:26:03Z DEBUG raw: adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG adtrust_is_enabled(version='2.251') 2024-12-04T14:26:03Z DEBUG raw: trustconfig_show(version='2.251') 2024-12-04T14:26:03Z DEBUG trustconfig_show(rights=False, trust_type='ad', all=False, raw=False, version='2.251') 2024-12-04T14:26:03Z DEBUG Processing trust domain object cn=trustd.trustdomain,cn=ad,cn=trusts,dc=freeipa,dc=testdomain 2024-12-04T14:26:03Z DEBUG Updating Kerberos principal entry for krbtgt/TRUSTD.TRUSTDOMAIN@FREEIPA.TESTDOMAIN 2024-12-04T14:26:03Z DEBUG No update was required for Kerberos principal krbtgt/TRUSTD.TRUSTDOMAIN@FREEIPA.TESTDOMAIN 2024-12-04T14:26:03Z DEBUG No need to update Kerberos keys for existing Kerberos principal krbtgt/TRUSTD.TRUSTDOMAIN@FREEIPA.TESTDOMAIN 2024-12-04T14:26:03Z DEBUG Adding Kerberos principal entry for krbtgt/TRUSTD@FREEIPA.TESTDOMAIN 2024-12-04T14:26:03Z DEBUG Destroyed connection context.ldap2_140061374847008 2024-12-04T14:26:03Z ERROR Upgrade failed with attribute "ipaAllowedToPerform;read_keys" not allowed 2024-12-04T14:26:03Z DEBUG Traceback (most recent call last): File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1093, in error_handler yield File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1669, in add_entry self.conn.add_s(str(entry.dn), list(attrs.items())) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 236, in add_s return self.add_ext_s(dn,modlist,None,None) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 222, in add_ext_s resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 543, in result3 resp_type, resp_data, resp_msgid, decoded_resp_ctrls, retoid, retval = self.result4( File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 553, in result4 ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ldap.OBJECT_CLASS_VIOLATION: {'msgtype': 105, 'msgid': 467, 'result': 65, 'desc': 'Object class violation', 'ctrls': [], 'info': 'attribute "ipaAllowedToPerform;read_keys" not allowed\n'} During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib64/python3/site-packages/ipaserver/install/upgradeinstance.py", line 291, in __upgrade self.modified = (ld.update(self.files) or self.modified) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 998, in update self._run_updates(all_updates) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 961, in _run_updates self._run_update_plugin(update['plugin']) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 938, in _run_update_plugin restart_ds, updates = self.api.Updater[plugin_name]() File "/usr/lib64/python3/site-packages/ipalib/frontend.py", line 1564, in __call__ return self.execute(**options) File "/usr/lib64/python3/site-packages/ipaserver/install/plugins/adtrust.py", line 705, in execute self.set_krb_principal([tgt_principal, nbt_principal], File "/usr/lib64/python3/site-packages/ipaserver/install/plugins/adtrust.py", line 598, in set_krb_principal action(entry) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1903, in add_entry super(LDAPCache, self).add_entry(entry) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1669, in add_entry self.conn.add_s(str(entry.dn), list(attrs.items())) File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__ self.gen.throw(typ, value, traceback) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1132, in error_handler raise errors.ObjectclassViolation(info=info) ipalib.errors.ObjectclassViolation: attribute "ipaAllowedToPerform;read_keys" not allowed 2024-12-04T14:26:03Z DEBUG Traceback (most recent call last): File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1093, in error_handler yield File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1669, in add_entry self.conn.add_s(str(entry.dn), list(attrs.items())) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 236, in add_s return self.add_ext_s(dn,modlist,None,None) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 222, in add_ext_s resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 543, in result3 resp_type, resp_data, resp_msgid, decoded_resp_ctrls, retoid, retval = self.result4( File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 553, in result4 ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) File "/usr/lib64/python3/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ldap.OBJECT_CLASS_VIOLATION: {'msgtype': 105, 'msgid': 467, 'result': 65, 'desc': 'Object class violation', 'ctrls': [], 'info': 'attribute "ipaAllowedToPerform;read_keys" not allowed\n'} During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib64/python3/site-packages/ipaserver/install/upgradeinstance.py", line 291, in __upgrade self.modified = (ld.update(self.files) or self.modified) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 998, in update self._run_updates(all_updates) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 961, in _run_updates self._run_update_plugin(update['plugin']) File "/usr/lib64/python3/site-packages/ipaserver/install/ldapupdate.py", line 938, in _run_update_plugin restart_ds, updates = self.api.Updater[plugin_name]() File "/usr/lib64/python3/site-packages/ipalib/frontend.py", line 1564, in __call__ return self.execute(**options) File "/usr/lib64/python3/site-packages/ipaserver/install/plugins/adtrust.py", line 705, in execute self.set_krb_principal([tgt_principal, nbt_principal], File "/usr/lib64/python3/site-packages/ipaserver/install/plugins/adtrust.py", line 598, in set_krb_principal action(entry) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1903, in add_entry super(LDAPCache, self).add_entry(entry) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1669, in add_entry self.conn.add_s(str(entry.dn), list(attrs.items())) File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__ self.gen.throw(typ, value, traceback) File "/usr/lib64/python3/site-packages/ipapython/ipaldap.py", line 1132, in error_handler raise errors.ObjectclassViolation(info=info) ipalib.errors.ObjectclassViolation: attribute "ipaAllowedToPerform;read_keys" not allowed During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib64/python3/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib64/python3/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib64/python3/site-packages/ipaserver/install/upgradeinstance.py", line 299, in __upgrade raise RuntimeError(e) RuntimeError: attribute "ipaAllowedToPerform;read_keys" not allowed 2024-12-04T14:26:03Z DEBUG [error] RuntimeError: attribute "ipaAllowedToPerform;read_keys" not allowed 2024-12-04T14:26:03Z DEBUG [cleanup]: stopping directory server 2024-12-04T14:26:03Z DEBUG Destroyed connection context.ldap2_140061389054016 2024-12-04T14:26:03Z DEBUG Starting external process 2024-12-04T14:26:03Z DEBUG args=['/sbin/systemctl', 'stop', 'dirsrv@FREEIPA-TESTDOMAIN.service'] 2024-12-04T14:26:06Z DEBUG Process finished, return code=0 2024-12-04T14:26:06Z DEBUG stdout= 2024-12-04T14:26:06Z DEBUG stderr= 2024-12-04T14:26:06Z DEBUG Stop of dirsrv@FREEIPA-TESTDOMAIN.service complete 2024-12-04T14:26:06Z DEBUG step duration: dirsrv __stop_instance 2.29 sec 2024-12-04T14:26:06Z DEBUG [cleanup]: restoring configuration 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2024-12-04T14:26:06Z DEBUG step duration: dirsrv __restore_config 0.06 sec 2024-12-04T14:26:06Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2024-12-04T14:26:06Z DEBUG File "/usr/lib64/python3/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib64/python3/site-packages/ipaserver/install/ipa_server_upgrade.py", line 56, in run raise admintool.ScriptError(str(e)) 2024-12-04T14:26:06Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: ('IPA upgrade failed.', 1) 2024-12-04T14:26:06Z ERROR ('IPA upgrade failed.', 1) 2024-12-04T14:26:06Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information