| | |
|---|
| | | objectClass: top |
|---|
| | | objectClass: ds-cfg-access-control-handler |
|---|
| | | objectClass: ds-cfg-dsee-compat-access-control-handler |
|---|
| | | # @aci Anonymous extended operation access: Anonymous and authenticated users can request the LDAP extended operations that are specified by OID. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (extop="1.3.6.1.4.1.26027.1.6.1 || 1.3.6.1.4.1.26027.1.6.3 || 1.3.6.1.4.1.4203.1.11.1 || 1.3.6.1.4.1.1466.20037 || 1.3.6.1.4.1.4203.1.11.3") (version 3.0; acl "Anonymous extended operation access"; allow(read) userdn="ldap:///anyone";) |
|---|
| | | # @aci Anonymous control access: Anonymous and authenticated users can use the LDAP controls that are specified by OID. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (targetcontrol="2.16.840.1.113730.3.4.2 || 2.16.840.1.113730.3.4.17 || 2.16.840.1.113730.3.4.19 || 1.3.6.1.4.1.4203.1.10.2 || 1.3.6.1.4.1.42.2.27.8.5.1 || 2.16.840.1.113730.3.4.16 || 1.2.840.113556.1.4.1413") (version 3.0; acl "Anonymous control access"; allow(read) userdn="ldap:///anyone";) |
|---|
| | | # @aci Authenticated users control access: Authenticated users can use the LDAP controls that are specified by OID. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (targetcontrol="1.3.6.1.1.12 || 1.3.6.1.1.13.1 || 1.3.6.1.1.13.2 || 1.2.840.113556.1.4.319 || 1.2.826.0.1.3344810.2.3 || 2.16.840.1.113730.3.4.18 || 2.16.840.1.113730.3.4.9 || 1.2.840.113556.1.4.473 || 1.3.6.1.4.1.42.2.27.9.5.9") (version 3.0; acl "Authenticated users control access"; allow(read) userdn="ldap:///all";) |
|---|
| | | # @aci Anonymous read access: Anonymous and authenticated users can read the user data attributes that are specified by their names. Modification or removal is permitted. |
|---|
| | | ds-cfg-global-aci: (targetattr!="userPassword||authPassword||debugsearchindex||changes||changeNumber||changeType||changeTime||targetDN||newRDN||newSuperior||deleteOldRDN")(version 3.0; acl "Anonymous read access"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | # @aci Self entry modification: Authenticated users can modify the specified attributes on their own entries. Modification or removal is permitted. |
|---|
| | | ds-cfg-global-aci: (targetattr="audio||authPassword||description||displayName||givenName||homePhone||homePostalAddress||initials||jpegPhoto||labeledURI||mobile||pager||postalAddress||postalCode||preferredLanguage||telephoneNumber||userPassword")(version 3.0; acl "Self entry modification"; allow (write) userdn="ldap:///self";) |
|---|
| | | # @aci Self entry read: Authenticated users can read the password values on their own entries. By default, the server applies a one-way hash algorithm to the password value before writing it to the entry, so it is computationally difficult to recover the cleartext version of the password from the stored value. Modification or removal is permitted. |
|---|
| | | ds-cfg-global-aci: (targetattr="userPassword||authPassword")(version 3.0; acl "Self entry read"; allow (read,search,compare) userdn="ldap:///self";) |
|---|
| | | # @aci User-Visible Schema Operational Attributes: Anonymous and authenticated users can read LDAP schema definitions. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (target="ldap:///cn=schema")(targetscope="base")(targetattr="objectClass||attributeTypes||dITContentRules||dITStructureRules||ldapSyntaxes||matchingRules||matchingRuleUse||nameForms||objectClasses")(version 3.0; acl "User-Visible Schema Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | # @aci User-Visible Root DSE Operational Attributes: Anonymous and authenticated users can read attributes that describe what the server supports. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (target="ldap:///")(targetscope="base")(targetattr="objectClass||namingContexts||supportedAuthPasswordSchemes||supportedControl||supportedExtension||supportedFeatures||supportedLDAPVersion||supportedSASLMechanisms||supportedTLSCiphers||supportedTLSProtocols||vendorName||vendorVersion")(version 3.0; acl "User-Visible Root DSE Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | # @aci User-Visible Operational Attributes: Anonymous and authenticated users can read attributes that identify entries and that contain information about modifications to entries. Modification or removal may affect applications. |
|---|
| | | ds-cfg-global-aci: (targetattr="createTimestamp||creatorsName||modifiersName||modifyTimestamp||entryDN||entryUUID||subschemaSubentry||etag||governingStructureRule||structuralObjectClass||hasSubordinates||numSubordinates||isMemberOf")(version 3.0; acl "User-Visible Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | cn: Access Control Handler |
|---|
| | | ds-cfg-java-class: org.opends.server.authorization.dseecompat.AciHandler |
|---|
