March 2003
Intermediate to advanced
308 pages
9h 36m
English
Grant
authenticated users the capability to read the cn
attribute with the following:
access to attrs=cn
by users readGrant a single, specified user the capability to write to all
posixAccount entries below the
ou=people container with the following. This does
not include permission to add new entries directly below
ou=people.
access to dn.children="ou=people,dc=plainjoe,dc=org"
filter=(objectclass=posixAccount)
by dn="uid=admin,ou=people,dc=plainjoe,dc=org" writeGrant everyone the capability to attempt to authenticate against an entry’s password with the following. The owner of the entry should also be given read and write access.
access to attrs=userPassword by * +x continue by self +rw
Restrict access to the administration organizational unit to members
of the admin groupOfNames object with the
following:
access to dn.subtree="ou=administration,dc=plainjoe,dc=org"
by group/groupOfNames/member=
"cn=admin,ou=group,dc=plainjoe,dc=org" write
by * noneRead now
Unlock full access