.nf
[dn[.<dnstyle>]=]<dnpattern>
filter=<ldapfilter>
- attrs=<attrlist>[ val[.<attrstyle>]=<attrval>]
+ attrs=<attrlist>[ val[/matchingRule][.<attrstyle>]=<attrval>]
.fi
.LP
with
is implied, i.e. all attributes are addressed.
.LP
Using the form
-.B attrs=<attr> val[.<attrstyle>]=<attrval>
+.B attrs=<attr> val[/matchingRule][.<attrstyle>]=<attrval>
specifies access to a particular value of a single attribute.
In this case, only a single attribute type may be given. The
.B <attrstyle>
.B exact
(the default) uses the attribute's equality matching rule to compare the
-value. If the
+value, unless a different (and compatible) matching rule is specified. If the
.B <attrstyle>
is
.BR regex ,
sasl_ssf=<n>
aci[=<attrname>]
- dynacl/name[.<dynstyle>][=<pattern>]
+ dynacl/name[/<options>][.<dynstyle>][=<pattern>]
.fi
.LP
with
and
.B <attrname>
define the objectClass and the member attributeType of the group entry.
+The defaults are
+.B groupOfNames
+and
+.BR member ,
+respectively.
The optional style qualifier
.B <style>
can be
ACIs are experimental; they must be enabled at compile time.
.LP
The statement
-.B dynacl/<name>[.<dynstyle>][=<pattern>]
+.B dynacl/<name>[/<options>][.<dynstyle>][=<pattern>]
means that access checking is delegated to the admin-defined method
indicated by
.BR <name> ,
.B moduleload
statement.
The fields
+.BR <options> ,
.B <dynstyle>
and
.B <pattern>
.LP
which grants everybody search and compare privileges, and adds read
privileges to authenticated clients.
+.LP
+One useful application is to easily grant write privileges to an
+.B updatedn
+that is different from the
+.BR rootdn .
+In this case, since the
+.B updatedn
+needs write access to (almost) all data, one can use
+.LP
+.nf
+ access to *
+ by dn.exact="cn=The Update DN,dc=example,dc=com" write
+ by * break
+.fi
+.LP
+as the first access rule.
+As a consequence, unless the operation is performed with the
+.B updatedn
+identity, control is passed straight to the subsequent rules.
.SH OPERATION REQUIREMENTS
Operations require different privileges on different portions of entries.
The following summary applies to primary database backends such as
.B modify
operation requires
.B write (=w)
-privileges on the attibutes being modified.
+privileges on the attributes being modified.
.LP
The
.B modrdn
attribute of the authorized identity.
.LP
-Some backends do not honor all the above rules. In detail:
-
-.TP
-.B bacl-ldap/back-meta
-\fIdo not check\fP
-.B write (=w)
-access, since it is delegated to the remote host(s) serving
-the naming context.
-The same applies to checking
-.B search (=s)
-access to the
-.B entry
-pseudo-attribute of the
-.B searchBase
-of a search operation,
-.B search (=s)
-access to the attributes used in the
-.BR searchFilter ,
-and
-.B disclose (=d)
-access to the
-.B entry
-pseudo-attribute of any object in case of error: all those checks
-are delegated to the remote host(s).
-In any case,
-.B read (=r)
-access is honored locally by the frontend.
+Access control to search entries is checked by the frontend,
+so it is fully honored by all backends; for all other operations
+and for the discovery phase of the search operation,
+full ACL semantics is only supported by the primary backends, i.e.
+.BR back-bdb (5),
+.BR back-hdb (5),
+and
+.BR back-ldbm (5).
-.TP
-.B back-shell
-requires
-.B write (=w)
-access to the
-.B entry
-pseudo-attribute for the modify operation; in the meanwhile,
-\fIwrite access to the specific attributes that are modified
-is not checked\fP.
+Some other backend, like
+.BR back-sql (5),
+may fully support them; others may only support a portion of the
+described semantics, or even differ in some aspects.
+The relevant details are described in the backend-specific man pages.
.SH CAVEATS
It is strongly recommended to explicitly use the most appropriate
and
.B <who>
clauses, to avoid possible incorrect specifications of the access rules
-as well as for performance (avoid unrequired regex matching when an exact
+as well as for performance (avoid unnecessary regex matching when an exact
match suffices) reasons.
.LP
An administrator might create a rule of the form:
default slapd configuration file
.SH SEE ALSO
.BR slapd (8),
+.BR slapd-* (5),
.BR slapacl (8),
.BR regex (7),
.BR re_format (7)