git.sur5r.net Git - openldap/blob - tests/data/slapd-acl.conf

   1 # $OpenLDAP$
   2 #
   3 # master slapd config -- for testing
   4 #
   5 ucdata-path     ./ucdata
   6 include ./schema/core.schema
   7 include ./schema/cosine.schema
   8 include ./schema/inetorgperson.schema
   9 include ./schema/openldap.schema
  10 pidfile     ./test-db/slapd.pid
  11 argsfile    ./test-db/slapd.args
  12
  13 # global ACLs
  14 access to dn.base="" attr=objectClass by users read
  15 access to * by * read
  16
  17 modulepath      ../servers/slapd/back-@BACKEND@/
  18 @MODULELOAD@
  19
  20 #######################################################################
  21 # ldbm database definitions
  22 #######################################################################
  23
  24 database        @BACKEND@
  25 #ldbm#cachesize 0
  26 suffix          "o=University of Michigan,c=US"
  27 directory       ./test-db
  28 rootdn          "cn=Manager,o=University of Michigan,c=US"
  29 rootpw          secret
  30 #ldbm#index             objectClass     eq
  31 #ldbm#index             cn,sn,uid       pres,eq,sub
  32 #bdb#index              objectClass     eq
  33 #bdb#index              cn,sn,uid       pres,eq,sub
  34
  35 #
  36 # normal installations should protect root dse, cn=monitor, cn=subschema
  37 #
  38
  39 access to dn="" by * read
  40 access to dn.base="" by * read
  41
  42 access          to attr=objectclass
  43                 by * =rsc stop
  44
  45 access          to filter="(objectclass=person)" attr=userpassword
  46                 by anonymous auth
  47                 by self write
  48
  49 access          to dn.children="ou=Alumni Association,ou=People,o=University of Michigan,c=US"
  50                 by dn.regex=".+,o=University of Michigan,c=US" +c continue
  51                 by dn.subtree="o=University of Michigan,c=US" +rs continue
  52                 by * stop
  53
  54 access          to attr=member
  55                 by dnattr=member selfwrite
  56                 by * read
  57
  58 access          to attr=member filter=(mail=*edu)
  59                 by * read
  60
  61 access          to filter="(objectclass=groupofnames)"
  62                 by dn.base="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US" =sc continue
  63                 by dn="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" +rw stop
  64                 by * break
  65
  66 access          to dn.children="ou=Information Technology Division,ou=People,o=University of Michigan,c=US"
  67                 by group.exact="cn=ITD Staff,ou=Groups,o=University of Michigan,c=US" write
  68                 by * read
  69
  70 access  to filter="(name=X*Y*Z)"
  71                 by * continue
  72
  73 # fall into global ACLs