freeipa/ipa-4-10 — Chinese (Simplified) (zh_CN) @ Fedora Weblate: Don't wait for rebuilding membership

English

Chinese (Simplified) (zh_CN)

Actions

Directory Server Access Control Instructions (ACIs)

ACIs are used to allow or deny access to information. This module is
currently designed to allow, not deny, access.

The aci commands are designed to grant permissions that allow updating
existing entries or adding or deleting new ones. The goal of the ACIs
that ship with IPA is to provide a set of low-level permissions that
grant access to special groups called taskgroups. These low-level
permissions can be combined into roles that grant broader access. These
roles are another type of group, roles.

For example, if you have taskgroups that allow adding and modifying users you
could create a role, useradmin. You would assign users to the useradmin
role to allow them to do the operations defined by the taskgroups.

You can create ACIs that delegate permission so users in group A can write
attributes on group B.

The type option is a map that applies to all entries in the users, groups or
host location. It is primarily designed to be used when granting add
permissions (to write new entries).

An ACI consists of three parts:
1. target
2. permissions
3. bind rules

The target is a set of rules that define which LDAP objects are being
targeted. This can include a list of attributes, an area of that LDAP
tree or an LDAP filter.

The targets include:
- attrs: list of attributes affected
- type: an object type (user, group, host, service, etc)
- memberof: members of a group
- targetgroup: grant access to modify a specific group. This is primarily
designed to enable users to add or remove members of a specific group.
- filter: A legal LDAP filter used to narrow the scope of the target.
- subtree: Used to apply a rule across an entire set of objects. For example,
to allow adding users you need to grant "add" permission to the subtree
ldap://uid=*,cn=users,cn=accounts,dc=example,dc=com. The subtree option
is a fail-safe for objects that may not be covered by the type option.

The permissions define what the ACI is allowed to do, and are one or
more of:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted

Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.

The bind rule defines who this ACI grants permissions to. The LDAP server
allows this to be any valid LDAP entry but we encourage the use of
taskgroups so that the rights can be easily shared through roles.

For a more thorough description of access controls see
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html

EXAMPLES:

NOTE: ACIs are now added via the permission plugin. These examples are to
demonstrate how the various options work but this is done via the permission
command-line now (see last example).

Add an ACI so that the group "secretaries" can update the address on any user:
ipa group-add --desc="Office secretaries" secretaries
ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses"

Show the new ACI:
ipa aci-show --prefix=none "Secretaries write addresses"

Add an ACI that allows members of the "addusers" permission to add new users:
ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users"

Add an ACI that allows members of the editors manage members of the admins group:
ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins"

Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group:
ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street --attrs=postalcode --prefix=none "admins edit the address of editors"

Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss:
ipa aci-add --permissions=write --group=admins --attrs=street --attrs=postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss"

Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission:
ipa permission-add --permissions=add --subtree="cn=*,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange

The show command shows the raw 389-ds ACI.

IMPORTANT: When modifying the target attributes of an existing ACI you
must include all existing attributes as well. When doing an aci-mod the
targetattr REPLACES the current attributes, it does not add to them.

Search for ACIs.

Returns a list of ACIs

EXAMPLES:

To find all ACIs that apply directly to members of the group ipausers:
ipa aci-find --memberof=ipausers

To find all ACIs that grant add access:
ipa aci-find --permissions=add

Note that the find command only looks for the given text in the set of
ACIs, it does not evaluate the ACIs to see if something would apply.
For example, searching on memberof=ipausers will find all ACIs that
have ipausers as a memberof. There may be other ACIs that apply to
members of that group indirectly.

Auto Membership Rule.

Bring clarity to the membership of hosts and users by configuring inclusive
or exclusive regex patterns, you can automatically assign a new entries into
a group or hostgroup based upon attribute information.

A rule is directly associated with a group by name, so you cannot create
a rule without an accompanying group or hostgroup.

A condition is a regular expression used by 389-ds to match a new incoming
entry with an automember rule. If it matches an inclusive rule then the
entry is added to the appropriate group or hostgroup.

A default group or hostgroup could be specified for entries that do not
match any rule. In case of user entries this group will be a fallback group
because all users are by default members of group specified in IPA config.

The automember-rebuild command can be used to retroactively run automember rules
against existing entries, thus rebuilding their membership.

EXAMPLES:

Add the initial group or hostgroup:
ipa hostgroup-add --desc="Web Servers" webservers
ipa group-add --desc="Developers" devel

Add the initial rule:
ipa automember-add --type=hostgroup webservers
ipa automember-add --type=group devel

Add a condition to the rule:
ipa automember-add-condition --key=fqdn --type=hostgroup --inclusive-regex=^web[1-9]+\.example\.com webservers
ipa automember-add-condition --key=manager --type=group --inclusive-regex=^uid=mscott devel

Add an exclusive condition to the rule to prevent auto assignment:
ipa automember-add-condition --key=fqdn --type=hostgroup --exclusive-regex=^web5\.example\.com webservers

Add a host:
ipa host-add web1.example.com

Add a user:
ipa user-add --first=Tim --last=User --password tuser1 --manager=mscott

Verify automembership:
ipa hostgroup-show webservers
Host-group: webservers
Description: Web Servers
Member hosts: web1.example.com

ipa group-show devel
Group name: devel
Description: Developers
GID: 1004200000
Member users: tuser

Remove a condition from the rule:
ipa automember-remove-condition --key=fqdn --type=hostgroup --inclusive-regex=^web[1-9]+\.example\.com webservers

Modify the automember rule:
ipa automember-mod

Set the default (fallback) target group:
ipa automember-default-group-set --default-group=webservers --type=hostgroup
ipa automember-default-group-set --default-group=ipausers --type=group

Remove the default (fallback) target group:
ipa automember-default-group-remove --type=hostgroup
ipa automember-default-group-remove --type=group

Show the default (fallback) target group:
ipa automember-default-group-show --type=hostgroup
ipa automember-default-group-show --type=group

Find all of the automember rules:
ipa automember-find

Display a automember rule:
ipa automember-show --type=hostgroup webservers
ipa automember-show --type=group devel

Delete an automember rule:
ipa automember-del --type=hostgroup webservers
ipa automember-del --type=group devel

Rebuild membership for all users:
ipa automember-rebuild --type=group

Rebuild membership for all hosts:
ipa automember-rebuild --type=hostgroup

Rebuild membership for specified users:
ipa automember-rebuild --users=tuser1 --users=tuser2

Rebuild membership for specified hosts:
ipa automember-rebuild --hosts=web1.example.com --hosts=web2.example.com

Automount

Stores automount(8) configuration for autofs(8) in IPA.

The base of an automount configuration is the configuration file auto.master.
This is also the base location in IPA. Multiple auto.master configurations
can be stored in separate locations. A location is implementation-specific
with the default being a location named 'default'. For example, you can have
locations by geographic region, by floor, by type, etc.

Automount has three basic object types: locations, maps and keys.

A location defines a set of maps anchored in auto.master. This allows you
to store multiple automount configurations. A location in itself isn't
very interesting, it is just a point to start a new automount map.

A map is roughly equivalent to a discrete automount file and provides
storage for keys.

A key is a mount point associated with a map.

When a new location is created, two maps are automatically created for
it: auto.master and auto.direct. auto.master is the root map for all
automount maps for the location. auto.direct is the default map for
direct mounts and is mounted on /-.

An automount map may contain a submount key. This key defines a mount
location within the map that references another map. This can be done
either using automountmap-add-indirect --parentmap or manually
with automountkey-add and setting info to "-type=autofs :<mapname>".

EXAMPLES:

Locations:

Create a named location, "Baltimore":
ipa automountlocation-add baltimore

Display the new location:
ipa automountlocation-show baltimore

Find available locations:
ipa automountlocation-find

Remove a named automount location:
ipa automountlocation-del baltimore

Show what the automount maps would look like if they were in the filesystem:
ipa automountlocation-tofiles baltimore

Import an existing configuration into a location:
ipa automountlocation-import baltimore /etc/auto.master

The import will fail if any duplicate entries are found. For
continuous operation where errors are ignored, use the --continue
option.

Maps:

Create a new map, "auto.share":
ipa automountmap-add baltimore auto.share

Display the new map:
ipa automountmap-show baltimore auto.share

Find maps in the location baltimore:
ipa automountmap-find baltimore

Create an indirect map with auto.share as a submount:
ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.man

This is equivalent to:

ipa automountmap-add-indirect baltimore --mount=/man auto.man
ipa automountkey-add baltimore auto.man --key=sub --info="-fstype=autofs ldap:auto.share"

Remove the auto.share map:
ipa automountmap-del baltimore auto.share

Keys:

Create a new key for the auto.share map in location baltimore. This ties
the map we previously created to auto.master:
ipa automountkey-add baltimore auto.master --key=/share --info=auto.share

Create a new key for our auto.share map, an NFS mount for man pages:
ipa automountkey-add baltimore auto.share --key=man --info="-ro,soft,rsize=8192,wsize=8192 ipa.example.com:/shared/man"

Find all keys for the auto.share map:
ipa automountkey-find baltimore auto.share

Find all direct automount keys:
ipa automountkey-find baltimore --key=/-

Remove the man key from the auto.share map:
ipa automountkey-del baltimore auto.share --key=man

Plugin to make multiple ipa calls via one remote procedure call

To run this code in the lite-server

curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json

where the contents of the file batch_request.json follow the below example

{"method":"batch","params":[[
{"method":"group_find","params":[[],{}]},
{"method":"user_find","params":[[],{"whoami":"true","all":"true"}]},
{"method":"user_show","params":[["admin"],{"all":true}]}
],{}],"id":1}

The format of the response is nested the same way. At the top you will see
"error": null,
"id": 1,
"result": {
"count": 3,
"results": [

And then a nested response for each IPA command method sent in the request

IPA certificate operations

Implements a set of commands for managing server SSL certificates.

Certificate requests exist in the form of a Certificate Signing Request (CSR)
in PEM format.

The dogtag CA uses just the CN value of the CSR and forces the rest of the
subject to values configured in the server.

A certificate is stored with a service principal and a service principal
needs a host.

In order to request a certificate:

* The host must exist
* The service must exist (or you use the --add option to automatically add it)

SEARCHING:

Certificates may be searched on by certificate subject, serial number,
revocation reason, validity dates and the issued date.

When searching on dates the _from date does a >= search and the _to date
does a <= search. When combined these are done as an AND.

Dates are treated as GMT to match the dates in the certificates.

The date format is YYYY-mm-dd.

EXAMPLES:

Request a new certificate and add the principal:
ipa cert-request --add --principal=HTTP/lion.example.com example.csr

Retrieve an existing certificate:
ipa cert-show 1032

Revoke a certificate (see RFC 5280 for reason details):
ipa cert-revoke --revocation-reason=6 1032

Remove a certificate from revocation hold status:
ipa cert-remove-hold 1032

Check the status of a signing request:
ipa cert-status 10

Search for certificates by hostname:
ipa cert-find --subject=ipaserver.example.com

Search for revoked certificates by reason:
ipa cert-find --revocation-reason=5

Search for certificates based on issuance date
ipa cert-find --issuedon-from=2013-02-01 --issuedon-to=2013-02-07

IPA currently immediately issues (or declines) all certificate requests so
the status of a request is not normally useful. This is for future use
or the case where a CA does not immediately issue a certificate.

The following revocation reasons are supported:

* 0 - unspecified
* 1 - keyCompromise
* 2 - cACompromise
* 3 - affiliationChanged
* 4 - superseded
* 5 - cessationOfOperation
* 6 - certificateHold
* 8 - removeFromCRL
* 9 - privilegeWithdrawn
* 10 - aACompromise

Note that reason code 7 is not used. See RFC 5280 for more details:

http://www.ietf.org/rfc/rfc5280.txt

English	Chinese (Simplified) (zh_CN)
No related strings found in the glossary.

English

Chinese (Simplified) (zh_CN)

No related strings found in the glossary.

	English	Chinese (Simplified) (zh_CN)	Actions
	File containing data to archive	文件包含库私钥
	Directory Server Access Control Instructions (ACIs) ACIs are used to allow or deny access to information. This module is currently designed to allow, not deny, access. The aci commands are designed to grant permissions that allow updating existing entries or adding or deleting new ones. The goal of the ACIs that ship with IPA is to provide a set of low-level permissions that grant access to special groups called taskgroups. These low-level permissions can be combined into roles that grant broader access. These roles are another type of group, roles. For example, if you have taskgroups that allow adding and modifying users you could create a role, useradmin. You would assign users to the useradmin role to allow them to do the operations defined by the taskgroups. You can create ACIs that delegate permission so users in group A can write attributes on group B. The type option is a map that applies to all entries in the users, groups or host location. It is primarily designed to be used when granting add permissions (to write new entries). An ACI consists of three parts: 1. target 2. permissions 3. bind rules The target is a set of rules that define which LDAP objects are being targeted. This can include a list of attributes, an area of that LDAP tree or an LDAP filter. The targets include: - attrs: list of attributes affected - type: an object type (user, group, host, service, etc) - memberof: members of a group - targetgroup: grant access to modify a specific group. This is primarily designed to enable users to add or remove members of a specific group. - filter: A legal LDAP filter used to narrow the scope of the target. - subtree: Used to apply a rule across an entire set of objects. For example, to allow adding users you need to grant "add" permission to the subtree ldap://uid=,cn=users,cn=accounts,dc=example,dc=com. The subtree option is a fail-safe for objects that may not be covered by the type option. The permissions define what the ACI is allowed to do, and are one or more of: 1. write - write one or more attributes 2. read - read one or more attributes 3. add - add a new entry to the tree 4. delete - delete an existing entry 5. all - all permissions are granted Note the distinction between attributes and entries. The permissions are independent, so being able to add a user does not mean that the user will be editable. The bind rule defines who this ACI grants permissions to. The LDAP server allows this to be any valid LDAP entry but we encourage the use of taskgroups so that the rights can be easily shared through roles. For a more thorough description of access controls see http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html EXAMPLES: NOTE: ACIs are now added via the permission plugin. These examples are to demonstrate how the various options work but this is done via the permission command-line now (see last example). Add an ACI so that the group "secretaries" can update the address on any user: ipa group-add --desc="Office secretaries" secretaries ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses" Show the new ACI: ipa aci-show --prefix=none "Secretaries write addresses" Add an ACI that allows members of the "addusers" permission to add new users: ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users" Add an ACI that allows members of the editors manage members of the admins group: ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins" Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group: ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street --attrs=postalcode --prefix=none "admins edit the address of editors" Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss: ipa aci-add --permissions=write --group=admins --attrs=street --attrs=postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss" Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission: ipa permission-add --permissions=add --subtree="cn=,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange The show command shows the raw 389-ds ACI. IMPORTANT: When modifying the target attributes of an existing ACI you must include all existing attributes as well. When doing an aci-mod the targetattr REPLACES the current attributes, it does not add to them.
	Attributes to which the permission applies	权限应用属性。
	Subtree to apply ACI to
	Group to apply ACI to	待应用权限的用户组
	The primary_key value of the entry, e.g. 'jdoe' for a user
	Search for ACIs. Returns a list of ACIs EXAMPLES: To find all ACIs that apply directly to members of the group ipausers: ipa aci-find --memberof=ipausers To find all ACIs that grant add access: ipa aci-find --permissions=add Note that the find command only looks for the given text in the set of ACIs, it does not evaluate the ACIs to see if something would apply. For example, searching on memberof=ipausers will find all ACIs that have ipausers as a memberof. There may be other ACIs that apply to members of that group indirectly.
	Auto Membership Rule. Bring clarity to the membership of hosts and users by configuring inclusive or exclusive regex patterns, you can automatically assign a new entries into a group or hostgroup based upon attribute information. A rule is directly associated with a group by name, so you cannot create a rule without an accompanying group or hostgroup. A condition is a regular expression used by 389-ds to match a new incoming entry with an automember rule. If it matches an inclusive rule then the entry is added to the appropriate group or hostgroup. A default group or hostgroup could be specified for entries that do not match any rule. In case of user entries this group will be a fallback group because all users are by default members of group specified in IPA config. The automember-rebuild command can be used to retroactively run automember rules against existing entries, thus rebuilding their membership. EXAMPLES: Add the initial group or hostgroup: ipa hostgroup-add --desc="Web Servers" webservers ipa group-add --desc="Developers" devel Add the initial rule: ipa automember-add --type=hostgroup webservers ipa automember-add --type=group devel Add a condition to the rule: ipa automember-add-condition --key=fqdn --type=hostgroup --inclusive-regex=^web[1-9]+\.example\.com webservers ipa automember-add-condition --key=manager --type=group --inclusive-regex=^uid=mscott devel Add an exclusive condition to the rule to prevent auto assignment: ipa automember-add-condition --key=fqdn --type=hostgroup --exclusive-regex=^web5\.example\.com webservers Add a host: ipa host-add web1.example.com Add a user: ipa user-add --first=Tim --last=User --password tuser1 --manager=mscott Verify automembership: ipa hostgroup-show webservers Host-group: webservers Description: Web Servers Member hosts: web1.example.com ipa group-show devel Group name: devel Description: Developers GID: 1004200000 Member users: tuser Remove a condition from the rule: ipa automember-remove-condition --key=fqdn --type=hostgroup --inclusive-regex=^web[1-9]+\.example\.com webservers Modify the automember rule: ipa automember-mod Set the default (fallback) target group: ipa automember-default-group-set --default-group=webservers --type=hostgroup ipa automember-default-group-set --default-group=ipausers --type=group Remove the default (fallback) target group: ipa automember-default-group-remove --type=hostgroup ipa automember-default-group-remove --type=group Show the default (fallback) target group: ipa automember-default-group-show --type=hostgroup ipa automember-default-group-show --type=group Find all of the automember rules: ipa automember-find Display a automember rule: ipa automember-show --type=hostgroup webservers ipa automember-show --type=group devel Delete an automember rule: ipa automember-del --type=hostgroup webservers ipa automember-del --type=group devel Rebuild membership for all users: ipa automember-rebuild --type=group Rebuild membership for all hosts: ipa automember-rebuild --type=hostgroup Rebuild membership for specified users: ipa automember-rebuild --users=tuser1 --users=tuser2 Rebuild membership for specified hosts: ipa automember-rebuild --hosts=web1.example.com --hosts=web2.example.com
	Default group for entries to land	新用户的默认组没有找到
	Default (fallback) group for entries to land	对所有不匹配的条目设置默认（回退）组。
	Delete an attribute/value pair. The option will be evaluated last, after all sets and adds.
	Rebuild auto membership.	重建自动成员
	Rebuild membership for all members of a grouping
	Rebuild membership for specified users
	Rebuild membership for specified hosts
	Don't wait for rebuilding membership	你确定要重建自动成员吗？
	Automount Stores automount(8) configuration for autofs(8) in IPA. The base of an automount configuration is the configuration file auto.master. This is also the base location in IPA. Multiple auto.master configurations can be stored in separate locations. A location is implementation-specific with the default being a location named 'default'. For example, you can have locations by geographic region, by floor, by type, etc. Automount has three basic object types: locations, maps and keys. A location defines a set of maps anchored in auto.master. This allows you to store multiple automount configurations. A location in itself isn't very interesting, it is just a point to start a new automount map. A map is roughly equivalent to a discrete automount file and provides storage for keys. A key is a mount point associated with a map. When a new location is created, two maps are automatically created for it: auto.master and auto.direct. auto.master is the root map for all automount maps for the location. auto.direct is the default map for direct mounts and is mounted on /-. An automount map may contain a submount key. This key defines a mount location within the map that references another map. This can be done either using automountmap-add-indirect --parentmap or manually with automountkey-add and setting info to "-type=autofs :<mapname>". EXAMPLES: Locations: Create a named location, "Baltimore": ipa automountlocation-add baltimore Display the new location: ipa automountlocation-show baltimore Find available locations: ipa automountlocation-find Remove a named automount location: ipa automountlocation-del baltimore Show what the automount maps would look like if they were in the filesystem: ipa automountlocation-tofiles baltimore Import an existing configuration into a location: ipa automountlocation-import baltimore /etc/auto.master The import will fail if any duplicate entries are found. For continuous operation where errors are ignored, use the --continue option. Maps: Create a new map, "auto.share": ipa automountmap-add baltimore auto.share Display the new map: ipa automountmap-show baltimore auto.share Find maps in the location baltimore: ipa automountmap-find baltimore Create an indirect map with auto.share as a submount: ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.man This is equivalent to: ipa automountmap-add-indirect baltimore --mount=/man auto.man ipa automountkey-add baltimore auto.man --key=sub --info="-fstype=autofs ldap:auto.share" Remove the auto.share map: ipa automountmap-del baltimore auto.share Keys: Create a new key for the auto.share map in location baltimore. This ties the map we previously created to auto.master: ipa automountkey-add baltimore auto.master --key=/share --info=auto.share Create a new key for our auto.share map, an NFS mount for man pages: ipa automountkey-add baltimore auto.share --key=man --info="-ro,soft,rsize=8192,wsize=8192 ipa.example.com:/shared/man" Find all keys for the auto.share map: ipa automountkey-find baltimore auto.share Find all direct automount keys: ipa automountkey-find baltimore --key=/- Remove the man key from the auto.share map: ipa automountkey-del baltimore auto.share --key=man
	Time limit of search in seconds	时间限制在几秒钟内的搜索（0代表无限制）
	Plugin to make multiple ipa calls via one remote procedure call To run this code in the lite-server curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json where the contents of the file batch_request.json follow the below example {"method":"batch","params":[[ {"method":"group_find","params":[[],{}]}, {"method":"user_find","params":[[],{"whoami":"true","all":"true"}]}, {"method":"user_show","params":[["admin"],{"all":true}]} ],{}],"id":1} The format of the response is nested the same way. At the top you will see "error": null, "id": 1, "result": { "count": 3, "results": [ And then a nested response for each IPA command method sent in the request
	IPA certificate operations Implements a set of commands for managing server SSL certificates. Certificate requests exist in the form of a Certificate Signing Request (CSR) in PEM format. The dogtag CA uses just the CN value of the CSR and forces the rest of the subject to values configured in the server. A certificate is stored with a service principal and a service principal needs a host. In order to request a certificate: * The host must exist * The service must exist (or you use the --add option to automatically add it) SEARCHING: Certificates may be searched on by certificate subject, serial number, revocation reason, validity dates and the issued date. When searching on dates the _from date does a >= search and the _to date does a <= search. When combined these are done as an AND. Dates are treated as GMT to match the dates in the certificates. The date format is YYYY-mm-dd. EXAMPLES: Request a new certificate and add the principal: ipa cert-request --add --principal=HTTP/lion.example.com example.csr Retrieve an existing certificate: ipa cert-show 1032 Revoke a certificate (see RFC 5280 for reason details): ipa cert-revoke --revocation-reason=6 1032 Remove a certificate from revocation hold status: ipa cert-remove-hold 1032 Check the status of a signing request: ipa cert-status 10 Search for certificates by hostname: ipa cert-find --subject=ipaserver.example.com Search for revoked certificates by reason: ipa cert-find --revocation-reason=5 Search for certificates based on issuance date ipa cert-find --issuedon-from=2013-02-01 --issuedon-to=2013-02-07 IPA currently immediately issues (or declines) all certificate requests so the status of a request is not normally useful. This is for future use or the case where a CA does not immediately issue a certificate. The following revocation reasons are supported: * 0 - unspecified * 1 - keyCompromise * 2 - cACompromise * 3 - affiliationChanged * 4 - superseded * 5 - cessationOfOperation * 6 - certificateHold * 8 - removeFromCRL * 9 - privilegeWithdrawn * 10 - aACompromise Note that reason code 7 is not used. See RFC 5280 for more details: http://www.ietf.org/rfc/rfc5280.txt
	Match cn attribute in subject	用户对象的用户名属性
	Valid not after from this date (YYYY-mm-dd)
	Valid not after to this date (YYYY-mm-dd)
	Valid not before from this date (YYYY-mm-dd)
	Valid not before to this date (YYYY-mm-dd)
	Issued on from this date (YYYY-mm-dd)
	Issued on to this date (YYYY-mm-dd)
	Revoked on from this date (YYYY-mm-dd)
	Revoked on to this date (YYYY-mm-dd)
	Take a revoked certificate off hold.	撤销证书。
	CSR

Shortcut	Action
`?`	Open available keyboard shortcuts.
`Alt` + `Home`	Navigate to the first translation in the current search.
`Alt` + `End`	Navigate to the last translation in the current search.
`Alt` + `PageUp` or `Ctrl` + `↑` or `Alt` + `↑` or `Cmd` + `↑` or	Navigate to the last translation in the current search.
`Alt` + `PageDown` or `Ctrl` + `↓` or `Alt` + `↓` or `Cmd` + `↓` or	Navigate to the next translation in the current search.
`Ctrl` + `Enter` or `Cmd` + `Enter`	Submit current form; this works the same as pressing Save and continue while editing translation.
`Ctrl` + `Shift` + `Enter` or `Cmd` + `Shift` +`Enter`	Unmark translation as Needing edit and submit it.
`Alt` + `Enter` or `Option` + `Enter`	Submit the string as a suggestion; this works the same as pressing Suggest while editing translation.
`Ctrl` + `E` or `Cmd` + `E`	Focus on translation editor.
`Ctrl` + `U` or `Cmd` + `U`	Focus on comment editor.
`Ctrl` + `M` or `Cmd` + `M`	Shows Automatic suggestions tab.
`Ctrl` + `1` to `Ctrl` + `9` or `Cmd` + `1` to `Cmd` + `9`	Copies placeable of a given number from source string.
`Ctrl` + `M` followed by `1` to `9` or `Cmd` + `M` followed by `1` to `9`	Copy the machine translation of a given number to current translation.
`Ctrl` + `I` followed by `1` to `9` or `Cmd` + `I` followed by `1` to `9`	Ignore one item in the list of failing checks.
`Ctrl` + `J` or `Cmd` + `J`	Shows the Nearby strings tab.
`Ctrl` + `S` or `Cmd` + `S`	Focus on search field.
`Ctrl` + `O` or `Cmd` + `O`	Copy the source string.
`Ctrl` + `Y` or `Cmd` + `Y`	Toggle the Needs editing checkbox.
`→`	Browse the next translation string.
`←`	Browse the previous translation string.

freeipa

ipa-4-10

Chinese (Simplified) (zh_CN)

Translate

Translation

Things to check

Mismatched question mark

Glossary

11881789 String information

String age

Last updated

Source string age

Translation file