From a791a43de44115e6e7f9de49a88cc2d452eb91a4 Mon Sep 17 00:00:00 2001 From: neil_a_wilson <neil_a_wilson@localhost> Date: Sun, 29 Jul 2007 21:30:06 +0000 Subject: [PATCH] Implement support for restricting the set of tasks that can be invoked in the server. A new configuration attribute, ds-cfg-allowed-task, is now available in the cn=config entry, and any attempt to invoke a task whose fully-qualified class name is not included in this attribute will be rejected. --- opends/resource/schema/02-config.ldif | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/opends/resource/schema/02-config.ldif b/opends/resource/schema/02-config.ldif index e67d9eb..a8d3197 100644 --- a/opends/resource/schema/02-config.ldif +++ b/opends/resource/schema/02-config.ldif @@ -1530,6 +1530,8 @@ attributeTypes: ( 1.3.6.1.4.1.26027.1.1.455 NAME 'ds-task-disconnect-notify-client' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'OpenDS Directory Server' ) +attributeTypes: ( 1.3.6.1.4.1.26027.1.1.456 NAME 'ds-cfg-allowed-task' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'OpenDS Directory Server' ) objectClasses: ( 1.3.6.1.4.1.26027.1.2.1 NAME 'ds-cfg-access-control-handler' SUP top STRUCTURAL MUST ( cn $ ds-cfg-acl-handler-class $ ds-cfg-acl-handler-enabled ) @@ -1744,7 +1746,8 @@ ds-cfg-proxied-authorization-identity-mapper-dn $ ds-cfg-writability-mode $ ds-cfg-reject-unauthenticated-requests $ ds-cfg-bind-with-dn-requires-password $ ds-cfg-lookthrough-limit $ - ds-cfg-smtp-server ) X-ORIGIN 'OpenDS Directory Server' ) + ds-cfg-smtp-server $ ds-cfg-allowed-task ) + X-ORIGIN 'OpenDS Directory Server' ) objectClasses: ( 1.3.6.1.4.1.26027.1.2.41 NAME 'ds-cfg-root-dn' SUP top AUXILIARY MAY ds-cfg-alternate-bind-dn X-ORIGIN 'OpenDS Directory Server' ) objectClasses: ( 1.3.6.1.4.1.26027.1.2.42 NAME 'ds-cfg-root-dse' -- Gitblit v1.10.0