Configuring Privileges & Access Control

About Access Control Instructions OpenDJ directory server access control instructions (ACIs) exist as aci attribute values in the directory data. ACIs apply to a scope defined in the instruction, and set permissions that depend on what operation is requested, who requested the operation, and how the client connected to the server. For example, the ACIs on the following entry allow anonymous read access to all attributes except passwords, and allow full read-write access to directory administrators under dc=example,dc=com. dn: dc=example,dc=com objectClass: domain objectClass: top dc: example aci: (target ="ldap:///dc=example,dc=com")(targetattr != "userPassword")(version 3.0;acl "Anonymous read-search access"; allow (read, search, compare)(userdn = "ldap:///anyone");) aci: (target="ldap:///dc=example,dc=com") (targetattr = "*")(version 3.0; acl "allow all Admin group"; allow(all) groupdn = "ldap:///cn=Directory Administrators,ou=Groups,dc=example,dc=com";) ACI attribute values use a specific language described in this section. Although ACI attribute values can become difficult to read in LDIF, the basic syntax is simple. target-spec(version 3.0;acl "desc";permissions bind-rules;) The following list briefly explains the variables in the syntax above. target-spec Specifies the entries, attributes, controls, and extended operations to which the ACI applies. To include multiple target-spec specifications, enclose each specification in parentheses, (). desc Supplies a human-readable description of what the ACI does. permissions Defines which operations to allow, and which to deny. bind-rules Identify how the client performed the bind to the server in order for the ACI to apply. Separate multiple permissions bind-rules definitions with semicolons, ;.

ACI Target Specifications ACI target specifications identify the target type that must match or not match a particular target. (target = "ldap:///DN") (target != "ldap:///DN") Sets the scope to DN and child entries. You can use asterisks, *, to replace attribute types, attribute values, and entire DN components. In other words, the following specification targets both uid=bjensen,ou=People,dc=example,dc=com and also cn=Frank Zappa,ou=Musicians,dc=example,dc=com. (target = "ldap:///*=*,*,dc=example,dc=com") (targetattr = "attr") (targetattr != "attr") Here attr is an attribute type name, such as userPassword. Separate multiple attribute type names with ||. This specification affects the entry where the ACI is located, or the entries specified by other targets in the ACI. You can use an asterisk, *, to specify all non-operational attributes, although you will see better performance when explicitly including or excluding attribute types needed. If you do not include this target specification, then by default no attributes are affected by the ACI. (targetfilter = "ldap-filter") (targetfilter != "ldap-filter") Sets the scope to match the ldap-filter dynamically, as in an LDAP search. (targattrfilters = "expression") (targattrfilters != "expression") Use this target specification when managing changes made to particular attributes. Here expression takes one of the following forms. Separate expressions with semicolons, ;. add=attr:filter[&& attr:filter ...] delete=attr:filter[&& attr:filter ...] Here add is for operations creating attributes, delete for operatins removing them. Replace attr with an attribute type. Replace filter with an LDAP filter that corresponds to the attr attribute type. (targetscope = "base|onelevel|subtree|subordinate") (targetscope != "base|onelevel|subtree|subordinate") Here base refers to the entry where the ACI is defined, onelevel to immediate children, subtree to the base entry and all children, and subordinate to all children only. (targetcontrol = "OID") (targetcontrol != "OID") Here, OID is the object identifier for the LDAP control to target. Separate multiple OIDs with ||. (extop = "OID") (extop != "OID") Here OID is the object identifier for the extended operation to target. Separate multiple OIDs with ||.

ACI Permissions ACI permission definitions take one of the following forms. allow(op[, op ...]) deny(op[, op ...]) Although deny is supported, avoid restricting permissions by using deny. Instead, explicitly allow access only where needed. What looks harmless and simple in your lab examples can grow difficult to maintain in a real-world deployment with nested ACIs. Here op is one of the following. add Entry creation, as for an LDAP add operation all All permissions compare Attribute value comparison, as for an LDAP compare operation delete Entry deletion, as for an LDAP delete operation export Entry export during a modify DN operation import Entry import during a modify DN operation proxy Access the ACI target using the rights of another user read Read entries and attributes search Search the ACI targets. Needs to be combine with read in order to read the search results. selfwrite Add or delete own DN from a group write Modify attributes on ACI target entries

ACI Bind Rules ACI bind rules match characteristics of the client connection to the server. You use bind rules to restrict whether the ACI applies depending on who connected, and when, where, and how they connected. authmethod = "none|simple|ssl|sasl mech" authmethod != "none|simple|ssl|sasl mech" Here you use none to mean do not check, simple for simple authentication, ssl for LDAPS, sasl mech for SASL where mech is DIGEST-MD5, EXTERNAL, or GSSAPI. dayofweek = "day[, day ...]" dayofweek != "day[, day ...]" Here, day is one of sun, mon, tue, wed, thu, fri, sat. dns = "hostname" dns != "hostname" You can use asterisks, *, to replace name components, such as dns = "*.myCompany.com". groupdn = "ldap:///DN[|| ldap:///DN ...]" groupdn != "ldap:///DN[|| ldap:///DN ...]" Replace DN with the distinguished name of a group to permit or restrict access for members. ip = "addresses" ip != "addresses" Here addresses can be specified for IPv4 or IPv6. IPv6 addresses are specified in brackets as ldap://[address]/subnet-prefix where /subnet-prefix is optional. You can specify individual IPv4 addresses, addresses with asterisks (*) to replace subnets and host numbers, CIDR notation, and forms such as 192.168.0.*+255.255.255.0 to specify subnet masks. ssf = "strength" ssf !=! "strength" ssf > "strength" ssf >= "strength" ssf < "strength" ssf <= "strength" Here the security strength factor pertains to the cipher key strength for connections using DIGEST-MD5, GSSAPI, SSL, or TLS. timeofday = "hhmm" timeofday != "hhmm" timeofday > "hhmm" timeofday >= "hhmm" timeofday < "hhmm" timeofday <= "hhmm" Here hhmm is expressed as on a 24-hour clock. For example, 1:15 PM is written 1315. userattr = "attr#value" userattr != "attr#value" userattr = ldap-url#LDAPURL" userattr != ldap-url#LDAPURL" userattr = "[parent[child-level].]attr#GROUPDN|USERDN" userattr != "[parent[child-level].]attr#GROUPDN|USERDN" The userattr bind rule specifies an attribute that must match on both the bind entry and the target of the ACI. To match when the attribute on the bind DN entry corresponds directly to the attribute on the target entry, replace attr with the attribute type, and value with the attribute value. To match when the target entry is identified by an LDAP URL, and the bind DN is in the subtree of the DN of the LDAP URL, use ldap-url#LDAPURL. To match when the bind DN corresponds to a member of the group identified by the attr value on the target entry, use attr#GROUPDN. To match when the bind DN corresponds to the attr value on the target entry, use attr#USERDN. The optional inheritence specification, parent[child-level]., lets you specify how many levels below the target entry inherit the ACI. Here child-level is a number from 0 to 9, with 0 indicating the target entry only. Separate multiple child-level digits with commas (,). userdn = "ldap-url++[|| ldap-url++ ...]" userdn != "ldap-url++[|| ldap-url++ ...]" To match the bind DN, replace ldap-url++ with either a valid LDAP URL such as ldap:///uid=bjensen,ou=People,dc=example,dc=com, ldap:///dc=example,dc=com??sub?(uid=bjensen), or a special LDAP URL-like keyword from the following list. ldap:///all Match authenticated users. ldap:///anyone Match anonymous and authenticated users. ldap:///parent Match when the bind DN is a parent of the ACI target. ldap:///self Match when the bind DN entry corresponds to ACI target.