nicolabs/vegardit-docker-openldap
1
0
Fork 0
mirror of https://github.com/vegardit/docker-openldap.git synced 2026-05-21 12:14:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

simplify ACL definition

Browse source
This commit is contained in:
sebthom 2023-05-15 19:47:24 +02:00
parent 6b292a3c4c
commit 6581afa328
1 changed files with 15 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
image/ldifs/init_mdb_acls.ldif
View file

@ -8,30 +8,27 @@ changetype: modify
# configure ACLs
########################
replace: olcAccess
olcAccess: {0}to attrs=userPassword
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by self write
by anonymous auth
by * none
olcAccess: {1}to attrs=shadowLastChange
by self write
by users read
by * none
olcAccess: {2}to attrs=sshPublicKey
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by self write
by users read
by * none
# This ACL gives incoming connections the ability to read the rootDSE.
# It is important to allow this, as clients may need to obtain information from the base level (such as your supported SASL Mechanisms).
# The ".base" portion of the ACL restricts clients to querying only the top level
olcAccess: {3}to dn.base=""
olcAccess: {0}to dn.base=""
by * read
olcAccess: {4}to *
# allow ldap admins to change all attributes
olcAccess: {1}to *
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by users read
by anonymous auth
by * none
olcAccess: {2}to attrs=userPassword
by self write
by anonymous auth
by * none
olcAccess: {3}to attrs=sshPublicKey
by self write
by users read
by * none
olcAccess: {4}to attrs=shadowLastChange
by self write
by users read
by * none