Re: Enforcing attribute ACL on add operations

[manu@netbsd.org (Emmanuel Dreyfus)]

Pierangelo Masarati <ando@sys-net.it> wrote:

> I mean: test006 is broken now, we can no longer make test.  You should
> check why the test is broken and try to fix it :)  Probably, according
> to the old access rule, a user with "add" permission for entries is 
> adding an entry without having "add" permission on all the attributes.

The culprit is the ACL on attrs=objectclass at the top of the file:
access         to attrs=objectclass
                    by * =rsc stop

If I change it that way, test006 passes:
access         to attrs=objectclass
               by dn.exact="cn=Bjorn Jensen,ou=Information Technology
Division,ou=People,dc=example,dc=com" add
                by * =rsc stop

Not sure it is a correct fix, through.

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@netbsd.org