idnsUpdatePolicy is the attribute in LDAP to store update-policy.
Ah, thanks! Seems to be missing in the documentation.
I see that the setting has an effect because I can useti to grant all
updates on the zone - however, I cannot get it to do the following:
I have a host authenticating as host/foo.example.com(a)EXAMPLE.COM. I want
this host to be able to update *.foo.example.com. Now there exist quite a
few different versions about the grant statement, and I tried the following;
krb5-subdomain . ANY
krb5-subdomain * ANY
krb5-subdomain *.example.com. ANY
However, I cannot seem to get it to grant a subdomain update.
I can get this t owork, though:
krb5-self * ANY
I am a bit confused, because I found some sources saying krb5-self and
krb5-subdomain both append the realm to the host name, which would result in
in the above example. However, this would mean
the krb5-self example above would also not have worked for me…
Any hints on how I really get BIND to accept updates on all subdomains of
the FQDN that authenticated?