From 3f02855a9202d146ec2e87a7568180caec938235 Mon Sep 17 00:00:00 2001 From: dugan <dugan@localhost> Date: Wed, 25 Jul 2007 23:12:49 +0000 Subject: [PATCH] Add new ACI keyword "extop" that can be used to enforce access based on the OID of an extended operation. For example, a new global access extended operation rule is also being added: --- opendj-sdk/opends/resource/config/config.ldif | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/opendj-sdk/opends/resource/config/config.ldif b/opendj-sdk/opends/resource/config/config.ldif index f864c53..d3d2df8 100644 --- a/opendj-sdk/opends/resource/config/config.ldif +++ b/opendj-sdk/opends/resource/config/config.ldif @@ -51,6 +51,7 @@ objectClass: top objectClass: ds-cfg-access-control-handler objectClass: ds-cfg-dseecompat-access-control-handler +ds-cfg-global-aci: (extop="1.3.6.1.4.1.26027.1.6.1 || 1.3.6.1.4.1.4203.1.11.1 || 1.3.6.1.4.1.1466.20037 || 1.3.6.1.4.1.4203.1.11.3") (version 3.0; acl "Anonymous extended operation access"; allow(read) userdn="ldap:///anyone";) ds-cfg-global-aci: (targetcontrol="2.16.840.1.113730.3.4.2 || 2.16.840.1.113730.3.4.17 || 2.16.840.1.113730.3.4.19 || 1.3.6.1.4.1.4203.1.10.2") (version 3.0; acl "Anonymous control access"; allow(read) userdn="ldap:///anyone";) ds-cfg-global-aci: (targetattr!="userPassword||authPassword")(version 3.0; acl "Anonymous read access"; allow (read,search,compare) userdn="ldap:///anyone";) ds-cfg-global-aci: (targetattr="*")(version 3.0; acl "Self entry modification"; allow (write) userdn="ldap:///self";) -- Gitblit v1.10.0