Add global ACIs that allow anonymous read access to key operational attributes,
including many attributes in the root DSE and cn=schema, as well as other
attributes that show up in entries throughout the server.
OpenDS Issue Number: 1622
| | |
|---|
| | | objectClass: ds-cfg-dseecompat-access-control-handler |
|---|
| | | ds-cfg-global-aci: (targetattr!="userPassword||authPassword")(version 3.0; acl "Anonymous read access"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | ds-cfg-global-aci: (targetattr="*")(version 3.0; acl "Self entry modification"; allow (write) userdn="ldap:///self";) |
|---|
| | | ds-cfg-global-aci: (target="ldap:///cn=schema")(targetscope="base")(targetattr="attributeTypes||dITContentRules||dITStructureRules||ldapSyntaxes||matchingRules||matchingRuleUse||nameForms||objectClasses")(version 3.0; acl "User-Visible Schema Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | ds-cfg-global-aci: (targetattr="namingContexts||supportedAuthPasswordSchemes||supportedControl||supportedExtension||supportedFeatures||supportedSASLMechanisms||vendorName||vendorVersion")(version 3.0; acl "User-Visible Root DSE Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | ds-cfg-global-aci: (targetattr="createTimestamp||creatorsName||modifiersName||modifyTimestamp||entryDN||subschemaSubentry")(version 3.0; acl "User-Visible Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) |
|---|
| | | cn: Access Control Handler |
|---|
| | | ds-cfg-acl-handler-class: org.opends.server.authorization.dseecompat.AciProvider |
|---|
| | | ds-cfg-acl-handler-enabled: true |
|---|
