From acb2efde53086ebc5ac6d58a6ad1a78370ad06b0 Mon Sep 17 00:00:00 2001 From: Kurt Zeilenga Date: Sun, 16 Jun 2002 00:11:51 +0000 Subject: [PATCH] Add SSF access control example. --- doc/guide/admin/slapdconfig.sdf | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/doc/guide/admin/slapdconfig.sdf b/doc/guide/admin/slapdconfig.sdf index 5f58324bb4..90ed42ba73 100644 --- a/doc/guide/admin/slapdconfig.sdf +++ b/doc/guide/admin/slapdconfig.sdf @@ -741,11 +741,25 @@ This access directive grants read access to everyone. > by anonymous auth > by * read -This directive allows users to modify their own entries, -allows authenticate, and allows all others to read. -Note that only the first {{EX:by }} clause which matches applies. -Hence, the anonymous users are granted {{EX:auth}}, not {{EX:read}}. -The last clause could just as well have been "{{EX:by users read}}". +This directive allows users to modify their own entries, allows +authenticate, and allows all others to read. Note that only the +first {{EX:by }} clause which matches applies. Hence, the +anonymous users are granted {{EX:auth}}, not {{EX:read}}. The last +clause could just as well have been "{{EX:by users read}}". + +It is often desirable to restrict operations based upon the level +of protection in place. The following shows how security strength +factors (SSF) can be used. + +> access to * +> by ssf=128 self write +> by ssf=64 anonymous auth +> by ssf=64 users read + +This directive allows users to modify their own entries if security +protections have of strength 128 or better have been established, +allows simple authentication and read access when 64 or better +security protections have been established. The following example shows the use of a regular expression to select the entries by DN in two access directives where -- 2.39.5