X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=tests%2Fdata%2Fslapd-acl.conf;h=6e9590924633b2eaa02f0ddc7eefb089edfd1f67;hb=dfe5c1e74247ee5e5ceab9597389c386209b1f7d;hp=a4c7aa9b459b1b603c697ef9d973b507251e3783;hpb=7db89cb1c07e5526c4f134094f87535d7966b999;p=openldap diff --git a/tests/data/slapd-acl.conf b/tests/data/slapd-acl.conf index a4c7aa9b45..6e95909246 100644 --- a/tests/data/slapd-acl.conf +++ b/tests/data/slapd-acl.conf @@ -1,52 +1,146 @@ +# master slapd config -- for testing # $OpenLDAP$ +## This work is part of OpenLDAP Software . +## +## Copyright 1998-2011 The OpenLDAP Foundation. +## All rights reserved. +## +## Redistribution and use in source and binary forms, with or without +## modification, are permitted only as authorized by the OpenLDAP +## Public License. +## +## A copy of this license is available in the file LICENSE in the +## top-level directory of the distribution or, alternatively, at +## . + +include @SCHEMADIR@/core.schema +include @SCHEMADIR@/cosine.schema +include @SCHEMADIR@/inetorgperson.schema +include @SCHEMADIR@/openldap.schema +include @SCHEMADIR@/nis.schema +pidfile @TESTDIR@/slapd.1.pid +argsfile @TESTDIR@/slapd.1.args + +# global ACLs # -# master slapd config -- for testing +# normal installations should protect root dse, cn=monitor, cn=subschema # -include ./data/slapd.at.conf -include ./data/slapd.oc.conf -schemacheck off -pidfile ./test-db/slapd.pid -argsfile ./test-db/slapd.args + +access to dn.exact="" attrs=objectClass + by users read +access to * + by * read + +#mod#modulepath ../servers/slapd/back-@BACKEND@/ +#mod#moduleload back_@BACKEND@.la +#monitormod#modulepath ../servers/slapd/back-monitor/ +#monitormod#moduleload back_monitor.la ####################################################################### -# ldbm database definitions +# database definitions ####################################################################### -database ldbm -cachesize 0 -suffix "o=University of Michigan, c=US" -directory ./test-db -rootdn "cn=Manager, o=University of Michigan, c=US" -rootpw secret -index cn,sn,uid pres,eq,approx -index default none -lastmod on -defaultaccess none - -# -# normal installations should protect root dse, -# cn=monitor, cn=schema, and cn=config -# +database @BACKEND@ -access to attr=objectclass +suffix "dc=example,dc=com" +rootdn "cn=Manager,dc=example,dc=com" +rootpw secret +#~null~#directory @TESTDIR@/db.1.a +#indexdb#index objectClass eq +#indexdb#index cn,sn,uid pres,eq,sub +#ndb#dbname db_1 +#ndb#include @DATADIR@/ndb.conf +add_content_acl on +#access to attrs=objectclass dn.subtree="dc=example,dc=com" +access to attrs=objectclass + by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" add by * =rsc stop -access to filter="objectclass=person" attr=userpassword +#access to filter="(objectclass=person)" attrs=userpassword dn.subtree="dc=example,dc=com" +access to filter="(objectclass=person)" attrs=userpassword by anonymous auth - by self write + by self =wx + +access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" + attrs=cn val="Mark A Elliot" + by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by * break -access to dn=".*,ou=Alumni Association,ou=People,o=University of Michigan,c=US$" - by dn="^$" +x continue - by dn=".*,o=University of Michigan,c=US$" +rsc continue +access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" + attrs=cn val="Mark Elliot" + by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by * break + +access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" + attrs=cn + by * search + +access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" + attrs=cn val.regex="^John D.+" + by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by * break + +access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" + attrs=cn val.regex="^Jonath.+" + by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by * break + +access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" + attrs=cn + by * search + +access to dn.onelevel="ou=Information Technology Division,ou=People,dc=example,dc=com" + filter="(cn=*Jensen)" + attrs=cn val.regex=".*Jensen$" + by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read + by * break + +access to dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" + attrs=cn + by * search + +access to dn.children="ou=Alumni Association,ou=People,dc=example,dc=com" + by dn.regex=".+,dc=example,dc=com" +c continue + by dn.subtree="dc=example,dc=com" +rs continue + by dn.children="dc=example,dc=com" +d continue by * stop -access to attr=member +#access to attrs=member,uniquemember dn.subtree="dc=example,dc=com" +access to attrs=member,uniquemember + by dn.exact="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" selfwrite by dnattr=member selfwrite + by dnattr=uniquemember selfwrite + by * read + +#access to attrs=member,uniquemember filter="(mail=*com)" dn.subtree="dc=example,dc=com" +access to attrs=member,uniquemember filter="(mail=*com)" by * read -access to filter="objectclass=rfc822mailgroup" - by dn="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" =sc continue - by dn="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" +rw stop +#access to filter="(|(objectclass=groupofnames)(objectClass=groupofuniquenames))" dn.subtree="dc=example,dc=com" +access to filter="(|(objectclass=groupofnames)(objectClass=groupofuniquenames))" + by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" =sc continue + by dn.regex="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com$" +rw stop by * break -access to * by * read +access to dn.children="ou=Information Technology Division,ou=People,dc=example,dc=com" + by group/groupOfUniqueNames/uniqueMember.exact="cn=ITD Staff,ou=Groups,dc=example,dc=com" write + by * read + +access to dn.exact="cn=Alumni Assoc Staff,ou=Groups,dc=example,dc=com" + by set="[cn=Alumni Assoc Staff,ou=Groups,dc=example,dc=com]/member* & user" write + by * read + +#access to filter="(name=X*Y*Z)" dn.subtree="dc=example,dc=com" +access to filter="(name=X*Y*Z)" + by * continue + +access to dn.subtree="ou=Add & Delete,dc=example,dc=com" + by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" add + by dn.exact="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" delete + by dn.exact="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" write + by * read + +# fall into global ACLs + +#monitor#database monitor