| | |
| | | <literallayout class="monospaced"><replaceable |
| | | >op</replaceable>=<replaceable>attr1</replaceable>:<replaceable |
| | | >filter1</replaceable>[&& <replaceable |
| | | >attr2</replaceable>:<replaceable>filter2</replaceable> ...][;<replaceable |
| | | >attr2</replaceable>:<replaceable>filter2</replaceable> …][;<replaceable |
| | | >op</replaceable>=<replaceable>attr3</replaceable>:<replaceable |
| | | >filter3</replaceable>[&& <replaceable |
| | | >attr4</replaceable>:<replaceable>filter4</replaceable> ...] ...]</literallayout> |
| | | >attr4</replaceable>:<replaceable>filter4</replaceable> …] …]</literallayout> |
| | | <para>Here <replaceable>op</replaceable> can be either |
| | | <literal>add</literal> for operations creating attributes, or |
| | | <literal>delete</literal> for operations removing them. |
| | |
| | | <para>ACI permission definitions take one of the following forms.</para> |
| | | |
| | | <literallayout class="monospaced">allow(<replaceable |
| | | >action</replaceable>[, <replaceable>action</replaceable> ...])</literallayout> |
| | | >action</replaceable>[, <replaceable>action</replaceable> …])</literallayout> |
| | | <literallayout class="monospaced">deny(<replaceable |
| | | >action</replaceable>[, <replaceable>action</replaceable> ...])</literallayout> |
| | | >action</replaceable>[, <replaceable>action</replaceable> …])</literallayout> |
| | | |
| | | <tip> |
| | | <para>Although <literal>deny</literal> is supported, avoid restricting |
| | |
| | | </varlistentry> |
| | | <varlistentry> |
| | | <term><literal>dayofweek = "<replaceable>day</replaceable>[, <replaceable |
| | | >day</replaceable> ...]"</literal></term> |
| | | >day</replaceable> …]"</literal></term> |
| | | <term><literal>dayofweek != "<replaceable>day</replaceable>[, <replaceable |
| | | >day</replaceable> ...]"</literal></term> |
| | | >day</replaceable> …]"</literal></term> |
| | | <listitem> |
| | | <para>Replace <replaceable>day</replaceable> with one of |
| | | <literal>sun</literal>, <literal>mon</literal>, <literal>tue</literal>, |
| | |
| | | </varlistentry> |
| | | <varlistentry> |
| | | <term><literal>groupdn = "ldap:///<replaceable |
| | | >DN</replaceable>[|| ldap:///<replaceable>DN</replaceable> ...]"</literal></term> |
| | | >DN</replaceable>[|| ldap:///<replaceable>DN</replaceable> …]"</literal></term> |
| | | <term><literal>groupdn != "ldap:///<replaceable |
| | | >DN</replaceable>[|| ldap:///<replaceable>DN</replaceable> ...]"</literal></term> |
| | | >DN</replaceable>[|| ldap:///<replaceable>DN</replaceable> …]"</literal></term> |
| | | <listitem> |
| | | <para>Replace <replaceable>DN</replaceable> with the distinguished name |
| | | of a group to permit or restrict access for members.</para> |
| | |
| | | <term><literal>userattr != <replaceable |
| | | >ldap-url</replaceable>#LDAPURL"</literal></term> |
| | | <term><literal>userattr = "[parent[<replaceable |
| | | >child-level</replaceable>].]<replaceable>attr</replaceable |
| | | >child-level</replaceable>]. ]<replaceable>attr</replaceable |
| | | >#GROUPDN|USERDN"</literal></term> |
| | | <term><literal>userattr != "[parent[<replaceable |
| | | >child-level</replaceable>].]<replaceable>attr</replaceable |
| | | >child-level</replaceable>]. ]<replaceable>attr</replaceable |
| | | >#GROUPDN|USERDN"</literal></term> |
| | | <listitem> |
| | | <para>The <literal>userattr</literal> subject specifies an attribute |
| | |
| | | </varlistentry> |
| | | <varlistentry> |
| | | <term><literal>userdn = "<replaceable>ldap-url++</replaceable>[|| <replaceable |
| | | >ldap-url++</replaceable> ...]"</literal></term> |
| | | >ldap-url++</replaceable> …]"</literal></term> |
| | | <term><literal>userdn != "<replaceable>ldap-url++</replaceable>[|| <replaceable |
| | | >ldap-url++</replaceable> ...]"</literal></term> |
| | | >ldap-url++</replaceable> …]"</literal></term> |
| | | <listitem> |
| | | <para>To match the bind DN, replace <replaceable>ldap-url++</replaceable> |
| | | with either a valid LDAP URL such as |
| | |
| | | ds-cfg-return-bind-error-messages: false |
| | | ds-cfg-default-password-policy: cn=Default Password Policy,cn=Password Policies, |
| | | cn=config |
| | | ... |
| | | … |
| | | $ ldappasswordmodify |
| | | --port 1389 |
| | | --bindDN "uid=kvaughan,ou=people,dc=example,dc=com" |
| | |
| | | <para>Next, add a global ACI value that allows authenticated users to |
| | | perform read operations. You can use <command>dsconfig</command> |
| | | interactively to add the ACI value as shown below |
| | | <literal>(targetattr!=...userdn="ldap:///all";)</literal>.</para> |
| | | <literal>(targetattr!= … userdn="ldap:///all";)</literal>.</para> |
| | | |
| | | <programlisting language="ldif">global-aci: (targetattr!="userPassword|| |
| | | authPassword||changes||changeNumber||changeType||changeTime||targetDN||newRDN|| |