From fa5b7b746560868a2ba132a9332ee8801231a9f4 Mon Sep 17 00:00:00 2001 From: ludovicp <ludovicp@localhost> Date: Fri, 30 Jul 2010 15:00:21 +0000 Subject: [PATCH] Add a global ACI to prevent possible write access to subentries. --- opendj-sdk/opends/resource/config/config.ldif | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/opendj-sdk/opends/resource/config/config.ldif b/opendj-sdk/opends/resource/config/config.ldif index e372035..b697a7e 100644 --- a/opendj-sdk/opends/resource/config/config.ldif +++ b/opendj-sdk/opends/resource/config/config.ldif @@ -81,6 +81,7 @@ ds-cfg-global-aci: (targetattr="createTimestamp||creatorsName||modifiersName||modifyTimestamp||entryDN||entryUUID||subschemaSubentry")(version 3.0; acl "User-Visible Operational Attributes"; allow (read,search,compare) userdn="ldap:///anyone";) ds-cfg-global-aci: (target="ldap:///dc=replicationchanges")(targetattr="*")(version 3.0; acl "Replication backend access"; deny (all) userdn="ldap:///anyone";) ds-cfg-global-aci: (target="ldap:///cn=changelog")(targetattr="*")(version 3.0; acl "External changelog access"; deny (all) userdn="ldap:///anyone";) +ds-cfg-global-aci: (targetfilter="(|(objectclass=subentry)(objectclass=ldapsubentry))")(version 3.0; acl "Subentry write access"; deny (add,write,delete) userdn="ldap:///anyone";) cn: Access Control Handler ds-cfg-java-class: org.opends.server.authorization.dseecompat.AciHandler ds-cfg-enabled: true -- Gitblit v1.10.0