Configuring Privileges & Access Control

About Access Control Instructions OpenDJ directory server access control instructions (ACIs) exist as aci attribute values in the directory data. ACIs apply to a scope defined in the instruction, and set permissions that depend on what operation is requested, who requested the operation, and how the client connected to the server. For example, the ACIs on the following entry allow anonymous read access to all attributes except passwords, and allow full read-write access to directory administrators under dc=example,dc=com. dn: dc=example,dc=com objectClass: domain objectClass: top dc: example aci: (target ="ldap:///dc=example,dc=com")(targetattr != "userPassword")(version 3.0;acl "Anonymous read-search access"; allow (read, search, compare)(userdn = "ldap:///anyone");) aci: (target="ldap:///dc=example,dc=com") (targetattr = "*")(version 3.0; acl "allow all Admin group"; allow(all) groupdn = "ldap:///cn=Directory Administrators,ou=Groups,dc=example,dc=com";) ACI attribute values use a specific language described in this section. Although ACI attribute values can become difficult to read in LDIF, the basic syntax is simple. targets(version 3.0;acl "name";permissions subjects;) The following list briefly explains the variables in the syntax above. targets The targets specifies entries, attributes, controls, and extended operations to which the ACI applies. To include multiple targets, enclose each individual target in parentheses, (). When you specify multiple targets, all targets must match for the ACI to apply (AND). name Supplies a human-readable description of what the ACI does. permissions Defines which actions to allow, and which to deny. Paired with subjects. subjects Identify clients to which the ACI applies depending on who connected, and when, where, and how they connected. Paired with permissions. Separate multiple pairs of permissions subjects definitions with semicolons, ;. When you specify multiple permissions-subjects pairs, at least one must match (OR).

ACI Targets The seven types of ACI targets identify the objects to which the ACI applies. (target = "ldap:///DN") (target != "ldap:///DN") Sets the scope to the entry with distinguished name DN, and to child entries. You can use asterisks, *, to replace attribute types, attribute values, and entire DN components. In other words, the following specification targets both uid=bjensen,ou=People,dc=example,dc=com and also cn=Frank Zappa,ou=Musicians,dc=example,dc=com. (target = "ldap:///*=*,*,dc=example,dc=com") The DN must be in the subtree of the entry on which the ACI is defined. (targetattr = "attr-list") (targetattr != "attr-list") Replace attr-list with a list of attribute type names, such as userPassword, separating multiple attribute type names with ||. This specification affects the entry where the ACI is located, or the entries specified by other targets in the ACI. You can use an asterisk, *, to specify all non-operational attributes, although you will see better performance when explicitly including or excluding attribute types needed. You can use a plus, +, to specify all operational attributes. If you do not include this target specification, then by default no attributes are affected by the ACI. (targetfilter = "ldap-filter") (targetfilter != "ldap-filter") Sets the scope to match the ldap-filter dynamically, as in an LDAP search. The ldap-filter can be any valid LDAP filter. (targattrfilters = "expression") (targattrfilters != "expression") Use this target specification when managing changes made to particular attributes. Here expression takes one of the following forms. Separate expressions with semicolons, ;. op=attr1:filter1[&& attr2:filter2 ...][;op=attr3:filter3[&& attr4:filter4 ...] ...] Here op can be either add for operations creating attributes, or delete for operations removing them. Replace attr with an attribute type. Replace filter with an LDAP filter that corresponds to the attr attribute type. (targetscope = "base|onelevel|subtree|subordinate") Here base refers to the entry where the ACI is defined, onelevel to immediate children, subtree to the base entry and all children, and subordinate to all children only. If you do not specify targetscope, then the default is subtree. (targetcontrol = "OID") (targetcontrol != "OID") Replace OID with the object identifier for the LDAP control to target. Separate multiple OIDs with ||. This target cannot be restricted to a specific subtree by combining it with another target. (extop = "OID") (extop != "OID") Replace OID with the object identifier for the extended operation to target. Separate multiple OIDs with ||. This target cannot be restricted to a specific subtree by combining it with another target.

ACI Permissions ACI permission definitions take one of the following forms. allow(action[, action ...]) deny(action[, action ...]) Although deny is supported, avoid restricting permissions by using deny. Instead, explicitly allow access only where needed. What looks harmless and simple in your lab examples can grow difficult to maintain in a real-world deployment with nested ACIs. Replace action with one of the following. add Entry creation, as for an LDAP add operation all All permissions compare Attribute value comparison, as for an LDAP compare operation delete Entry deletion, as for an LDAP delete operation export Entry export during a modify DN operation import Entry import during a modify DN operation proxy Access the ACI target using the rights of another user read Read entries and attributes search Search the ACI targets. Needs to be combine with read in order to read the search results. selfwrite Add or delete own DN from a group write Modify attributes on ACI target entries

ACI Subjects ACI subjects match characteristics of the client connection to the server. Use subjects to restrict whether the ACI applies depending on who connected, and when, where, and how they connected. authmethod = "none|simple|ssl|sasl mech" authmethod != "none|simple|ssl|sasl mech" Here you use none to mean do not check, simple for simple authentication, ssl for LDAPS, sasl mech for SASL where mech is DIGEST-MD5, EXTERNAL, or GSSAPI. dayofweek = "day[, day ...]" dayofweek != "day[, day ...]" Replace day with one of sun, mon, tue, wed, thu, fri, sat. dns = "hostname" dns != "hostname" You can use asterisks, *, to replace name components, such as dns = "*.myCompany.com". groupdn = "ldap:///DN[|| ldap:///DN ...]" groupdn != "ldap:///DN[|| ldap:///DN ...]" Replace DN with the distinguished name of a group to permit or restrict access for members. ip = "addresses" ip != "addresses" Here addresses can be specified for IPv4 or IPv6. IPv6 addresses are specified in brackets as ldap://[address]/subnet-prefix where /subnet-prefix is optional. You can specify individual IPv4 addresses, addresses with asterisks (*) to replace subnets and host numbers, CIDR notation, and forms such as 192.168.0.*+255.255.255.0 to specify subnet masks. ssf = "strength" ssf !=! "strength" ssf > "strength" ssf >= "strength" ssf < "strength" ssf <= "strength" Here the security strength factor pertains to the cipher key strength for connections using DIGEST-MD5, GSSAPI, SSL, or TLS. timeofday = "hhmm" timeofday != "hhmm" timeofday > "hhmm" timeofday >= "hhmm" timeofday < "hhmm" timeofday <= "hhmm" Here hhmm is expressed as on a 24-hour clock. For example, 1:15 PM is written 1315. userattr = "attr#value" userattr != "attr#value" userattr = ldap-url#LDAPURL" userattr != ldap-url#LDAPURL" userattr = "[parent[child-level].]attr#GROUPDN|USERDN" userattr != "[parent[child-level].]attr#GROUPDN|USERDN" The userattr subject specifies an attribute that must match on both the bind entry and the target of the ACI. To match when the attribute on the bind DN entry corresponds directly to the attribute on the target entry, replace attr with the attribute type, and value with the attribute value. To match when the target entry is identified by an LDAP URL, and the bind DN is in the subtree of the DN of the LDAP URL, use ldap-url#LDAPURL. To match when the bind DN corresponds to a member of the group identified by the attr value on the target entry, use attr#GROUPDN. To match when the bind DN corresponds to the attr value on the target entry, use attr#USERDN. The optional inheritence specification, parent[child-level]., lets you specify how many levels below the target entry inherit the ACI. Here child-level is a number from 0 to 9, with 0 indicating the target entry only. Separate multiple child-level digits with commas (,). userdn = "ldap-url++[|| ldap-url++ ...]" userdn != "ldap-url++[|| ldap-url++ ...]" To match the bind DN, replace ldap-url++ with either a valid LDAP URL such as ldap:///uid=bjensen,ou=People,dc=example,dc=com, ldap:///dc=example,dc=com??sub?(uid=bjensen), or a special LDAP URL-like keyword from the following list. ldap:///all Match authenticated users. ldap:///anyone Match anonymous and authenticated users. ldap:///parent Match when the bind DN is a parent of the ACI target. ldap:///self Match when the bind DN entry corresponds to ACI target.