nicolabs/vegardit-docker-openldap
1
0
Fork 0
mirror of https://github.com/vegardit/docker-openldap.git synced 2026-05-21 12:14:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

rework ACL definition

Browse source
This commit is contained in:
sebthom 2023-05-15 20:51:42 +02:00
parent a4891009b7
commit ec36a934de
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
image/ldifs/init_mdb_acls.ldif
View file

@ -13,24 +13,27 @@ replace: olcAccess
# The ".base" portion of the ACL restricts clients to querying only the top level # The ".base" portion of the ACL restricts clients to querying only the top level
olcAccess: {0}to dn.base="" olcAccess: {0}to dn.base=""
by * read by * read
# allow ldap admins to change all attributes olcAccess: {1}to attrs=shadowLastChange
olcAccess: {1}to * by self write
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by users read by users read
by anonymous auth
by * none by * none
olcAccess: {2}to attrs=userPassword olcAccess: {2}to attrs=userPassword
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write
by self write by self write
by anonymous auth by anonymous auth
by * none by * none
olcAccess: {3}to attrs=sshPublicKey olcAccess: {3}to attrs=sshPublicKey
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write
by self write by self write
by users read by users read
by * none by * none
olcAccess: {4}to attrs=shadowLastChange olcAccess: {4}to *
by self write by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by users read by users read
by anonymous auth
by * none by * none