git.sur5r.net Git - openldap/blob - tests/data/slapd-acl.conf

   1 # $OpenLDAP$
   2 #
   3 # master slapd config -- for testing
   4 #
   5 ucdata-path     ./ucdata
   6 include ./schema/core.schema
   7 include ./schema/cosine.schema
   8 include ./schema/inetorgperson.schema
   9 include ./schema/openldap.schema
  10 include ./schema/nis.schema
  11 pidfile     ./testrun/slapd.1.pid
  12 argsfile    ./testrun/slapd.1.args
  13
  14 # global ACLs
  15 access to dn.base="" attr=objectClass by users read
  16 access to * by * read
  17
  18 modulepath      ../servers/slapd/back-@BACKEND@/
  19 @MODULELOAD@
  20
  21 #######################################################################
  22 # ldbm database definitions
  23 #######################################################################
  24
  25 database        @BACKEND@
  26 #ldbm#cachesize 0
  27 suffix          "o=University of Michigan,c=US"
  28 directory       ./testrun/db.1.a
  29 rootdn          "cn=Manager,o=University of Michigan,c=US"
  30 rootpw          secret
  31 #ldbm#index             objectClass     eq
  32 #ldbm#index             cn,sn,uid       pres,eq,sub
  33 #bdb#index              objectClass     eq
  34 #bdb#index              cn,sn,uid       pres,eq,sub
  35
  36 #
  37 # normal installations should protect root dse, cn=monitor, cn=subschema
  38 #
  39
  40 access to dn="" by * read
  41 access to dn.base="" by * read
  42
  43 access          to attr=objectclass
  44                 by * =rsc stop
  45
  46 access          to filter="(objectclass=person)" attr=userpassword dn.subtree=""
  47                 by anonymous auth
  48                 by self write
  49
  50 access          to dn.children="ou=Alumni Association,ou=People,o=University of Michigan,c=US"
  51                 by dn.regex=".+,o=University of Michigan,c=US" +c continue
  52                 by dn.subtree="o=University of Michigan,c=US" +rs continue
  53                 by * stop
  54
  55 access          to attr=member,uniquemember
  56                 by dnattr=member selfwrite
  57                 by dnattr=uniquemember selfwrite
  58                 by * read
  59
  60 access to attr=member,uniquemember filter=(mail=*edu)
  61                 by * read
  62
  63 access to filter="(&(objectclass=groupofnames)(objectClass=groupofuniquenames))"
  64                 by dn.base="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US" =sc continue
  65                 by dn.regex="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" +rw stop
  66                 by * break
  67
  68 access          to dn.children="ou=Information Technology Division,ou=People,o=University of Michigan,c=US"
  69                 by group/groupOfUniqueNames/uniqueMember.exact="cn=ITD Staff,ou=Groups,o=University of Michigan,c=US" write
  70                 by * read
  71
  72 access  to filter="(name=X*Y*Z)"
  73                 by * continue
  74
  75 # fall into global ACLs