Re: ACL to permit access to some attributes

[Tony Earnshaw <tonye@billy.demon.nl>]

fre, 02.04.2004 kl. 22.55 skrev Quanah Gibson-Mount:

> These are his current acl's:
> 
> access to dn.base=""
> by * read
> by * break
> 
> access to dn.base="cn=Subschema"
> by * read
> by * break
> 
> access to dn.children="dc=fadesa,dc=es" attrs=objectclass,mail
> by * read
> 
> Those have the base DN in where needed. ;)

Ah. I never saw that. The southern British have an expression "picking
up fag-ends" (something like "picking up old stogies" in Am. Eng.) and
means poking one's nose in.  That's what I was.

> What he said was, I saw this ACL as an example:
> 
> access to attrs=userPassword
>         by self write
>         by dn.exact="cn=admin,ou=users,dc=domain" write
>         by anonymous auth
> 
> Not that he was using it. ;)

Probably just as well :(

> >> Also, it is attrs= not attr= :)
> >
> > *shrug* - both work; I use attr for one, attrs for more than one.
> 
> Hm, I'll have to remember that... I don't see attr= documented in 
> slapd.access, I wonder if that is a bug.

Actually, I never discovered "attrs" until about a year ago.

--Tonni

-- 

mail: billy - at - billy.demon.nl
http://www.billy.demon.nl