directory-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Emmanuel Lecharny (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (DIRSERVER-1895) ACLs have no effect
Date Fri, 28 Jun 2019 06:35:00 GMT

     [ https://issues.apache.org/jira/browse/DIRSERVER-1895?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Emmanuel Lecharny updated DIRSERVER-1895:
-----------------------------------------
    Component/s:     (was: ldap)
                 aci

> ACLs have no effect
> -------------------
>
>                 Key: DIRSERVER-1895
>                 URL: https://issues.apache.org/jira/browse/DIRSERVER-1895
>             Project: Directory ApacheDS
>          Issue Type: Bug
>          Components: aci
>    Affects Versions: 2.0.0-M15
>         Environment: FreeBSD 9.1-RELEASE-p6
>            Reporter: Christian Felsing
>            Priority: Major
>              Labels: acl
>
> Following ACL does not what I expected:
> {
>     identificationTag "mtaAclElement",
>     precedence 0,
>     authenticationLevel simple,
>     itemOrUserFirst userFirst:
>     {
>         userClasses
>         {
>             name { "cn=mta,dc=ip6,dc=li" }
>         }
>         ,
>         userPermissions
>         {
>             {
>                 protectedItems
>                 {
>                     entry,
>                     attributeType
>                     {
>                         tsnetDomainName,
>                         tsnetMailHost,
>                         uid
>                     }
>                 }
>                 ,
>                 grantsAndDenials
>                 {
>                     grantBrowse,
>                     grantRead,
>                     grantReturnDN,
>                     grantCompare
>                 }
>             }
>         }
>     }
> }
> This ACL should allow DN cn=mta,dc=ip6,dc=li access to attributes
> uid
> tsnetDomainName
> tsnetMailHost
> and to list all DN entries. A test (temporary allow to list all
> attributes) proved that this ACL matches.
> but
> ldapsearch -H ldap://192.168.116.29:10389 -x -D "cn=mta,dc=ip6,dc=li" -w
> VerySecretPassword -b "dc=ip6,dc=li"
> lists DN entries only:
> # pug@felsing.net, freemail, ip6.li
> dn: uid=pug@felsing.net,ou=freemail,dc=ip6,dc=li
> ...
> Attributes listed on attributeType are not shown.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org


Mime
View raw message