| | |
| | | |
| | | <screen>$ dsconfig \ |
| | | set-access-control-handler-prop \ |
| | | --remove global-aci:\(targetattr!=\"userPassword\|\|authPassword\|\|changes\|\ |
| | | \|changeNumber\|\|changeType\|\|changeTime\|\|targetDN\|\|newRDN\|\ |
| | | \|newSuperior\|\|deleteOldRDN\|\|targetEntryUUID\|\|changeInitiatorsName\|\ |
| | | \|changeLogCookie\|\|includedAttributes\"\)\(version\ 3.0\;\ acl\ \"Anonymous\ |
| | | \ read\ access\"\;\ allow\ \(read,search,compare\)\ |
| | | \ userdn=\"ldap:///anyone\"\;\)\ |
| | | --hostname opendj.example.com \ |
| | | --port 4444 \ |
| | | --bindDN cn=Directory\ Manager \ |
| | | --bindPassword password \ |
| | | --remove=global-aci:'(targetattr!="userPassword||authPassword||changes|| |
| | | changeNumber||changeType||changeTime||targetDN||newRDN|| |
| | | newSuperior||deleteOldRDN||targetEntryUUID||changeInitiatorsName|| |
| | | changeLogCookie||includedAttributes")(version 3.0; acl "Anonymous |
| | | read access"; allow (read,search,compare) userdn="ldap:///anyone";)' \ |
| | | --hostname=opendj.example.com \ |
| | | --port=4444 \ |
| | | --bindDN=cn=Directory\ Manager \ |
| | | --bindPassword=password \ |
| | | --trustAll \ |
| | | --no-prompt</screen> |
| | | |
| | | <note>The above command sequence utilizes single quote encapsulation |
| | | of the "<literal>global-aci</literal>" value. This is simply to avoid |
| | | the need for extensive character escapes. If the quotes are removed, |
| | | the user will need to manually escape certain characters, such as pipe |
| | | (<literal>|</literal>) or exclamation points (<literal>!</literal>) to |
| | | avoid shell errors.</note> |
| | | |
| | | <para>If the <literal>global-aci</literal> does not match the ACI exactly |
| | | then the command fails to remove the value. An alternative approach is to |
| | | use the <command>dsconfig</command> command interactively, adding the |