ITS#2906: report invalid userPassword schemes, clarify documentation

[openldap] / doc / man / man5 / slapd.access.5

diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5
index 4769fa62740af552a4383b0dee5f2be957bf3178..f109d6d1db6b4a0ef501d8fd396f72fd31416779 100644 (file)
--- a/doc/man/man5/slapd.access.5
+++ b/doc/man/man5/slapd.access.5
@@ -1,5 +1,5 @@
 .TH SLAPD.ACCESS 5 "RELEASEDATE" "OpenLDAP LDVERSION"
-.\" Copyright 1998-2003 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 1998-2004 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .SH NAME
 slapd.access \- access configuration for slapd, the stand-alone LDAP daemon
@@ -91,11 +91,15 @@ or
 .B exact 
 (an alias of 
 .BR base )
-indicates the entry whose DN is equal to the pattern.
+indicates the entry whose DN is equal to the pattern;
 .B one
+(synonym of
+.BR onelevel )
 indicates all the entries immediately below the
 .BR pattern ,
-.B subtree
+.B sub
+(synonym of
+.BR subtree )
 indicates all entries in the subtree at the pattern,
 .B children
 indicates all the entries below (subordinate to) the pattern.
@@ -128,12 +132,7 @@ Actually, names in
 .B <attrlist>
 that are prefixed by
 .B @
-are directly treated as objectClass names, while names that 
-do not correspond to an attribute type are also searched 
-in the objectclass set.
-This latter behavior is deprecated and might not be supported
-in future releases.
-A name prefixed by
+are directly treated as objectClass names.  A name prefixed by
 .B !
 is also treated as an objectClass, but in this case the access rule
 affects the attributes that are not required nor allowed 
@@ -379,7 +378,7 @@ Its component are defined as
 .LP
 .nf
        <level> ::= none|auth|compare|search|read|write
-       <priv> ::= {=|+|-}{w|r|s|c|x}+
+       <priv> ::= {=|+|-}{w|r|s|c|x|0}+
 .fi
 .LP
 The modifier
@@ -443,7 +442,9 @@ for search,
 for compare, and
 .B x
 for authentication.
-More than one privilege can be added in one statement.
+More than one of the above privileges can be added in one statement.
+.B 0
+indicates no privileges and is used only by itself (e.g., +0).
 .LP
 The optional field
 .B <control>
@@ -589,6 +590,25 @@ access to the attribute holding the referral information
 (generally the
 .B ref
 attribute).
+.LP
+Some
+.B controls
+require specific access privileges.
+The
+.B proxyAuthz
+control requires
+.B auth (=x)
+privileges on all the attributes that are present in the search filter
+of the URI regexp maps (the right-hand side of the
+.B sasl-regexp
+directives).
+It also requires
+.B auth (=x)
+privileges on the
+.B saslAuthzTo
+attribute of the authorizing identity and/or on the 
+.B saslAuthzFrom
+attribute of the authorized identity.
 .SH CAVEATS
 It is strongly recommended to explicitly use the most appropriate
 .BR <dnstyle> ,