<!doctype html public "-//W30//DTD W3 HTML 2.0//EN">
<HTML>
<!-- This file was generated using SDF 2.001 by
Ian Clatworthy (ianc@mincom.com). SDF is freely
available from http://www.mincom.com/mtr/sdf. -->
<HEAD>
<TITLE>OpenLDAP Software 2.4 Administrator's Guide: Access Control</TITLE>
</HEAD>
<BODY>
<DIV CLASS="header">
<A HREF="http://www.OpenLDAP.org/">
<P><IMG SRC="../images/LDAPlogo.gif" ALIGN="Left" BORDER=0></P>
</A>
<DIV CLASS="navigate">
<P ALIGN="Center"><A HREF="index.html">Contents</A> | <A HREF="index.html">Parent Topic</A> | <A HREF="runningslapd.html">Previous Topic</A> | <A HREF="limits.html">Next Topic</A> <BR><A HREF="http://www.openldap.org/">Home</A> | <A HREF="../index.html">Catalog</A></P>
</DIV>
<BR CLEAR="Left">
</DIV>
<DIV CLASS="main">
<H1>8. Access Control</H1>
<HR>
<H2><A NAME="Introduction">8.1. Introduction</A></H2>
<P>As the directory gets populated with more and more data of varying sensitivity, controlling the kinds of access granted to the directory becomes more and more critical. For instance, the directory may contain data of a confidential nature that you may need to protect by contract or by law. Or, if using the directory to control access to other services, inappropriate access to the directory may create avenues of attack to your sites security that result in devastating damage to your assets.</P>
<P>Access to your directory can be configured via two methods, the first using <A HREF="slapdconfig.html">The slapd Configuration File</A> and the second using the <EM>slapd-config</EM>(5) format (<A HREF="slapdconf2.html">Configuring slapd</A>).</P>
<P>The default access control policy is allow read by all clients. Regardless of what access control policy is defined, the <EM>rootdn</EM> is always allowed full rights (i.e. auth, search, compare, read and write) on everything and anything.</P>
<P>As a consequence, it's useless (and results in a performance penalty) to explicitly list the <EM>rootdn</EM> among the <EM><by></EM> clauses.</P>
<P>The following sections will describe Access Control Lists in greater depth and follow with some examples and recommendations. See <EM>slapd.access</EM>(5) for complete details.</P>
<HR>
<H2><A NAME="Access Control via Static Configuration">8.2. Access Control via Static Configuration</A></H2>
<P>Access to entries and attributes is controlled by the access configuration file directive. The general form of an access line is:</P>
<PRE>
<access directive> ::= access to <what>
[by <who> [<access>] [<control>] ]+
<what> ::= * |
[dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
[filter=<ldapfilter>] [attrs=<attrlist>]
<basic-style> ::= regex | exact
<scope-style> ::= base | one | subtree | children
<attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist>
<attr> ::= <attrname> | entry | children
<who> ::= * | [anonymous | users | self
| dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
[dnattr=<attrname>]
[group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>]
[peername[.<basic-style>]=<regex>]
[sockname[.<basic-style>]=<regex>]
[domain[.<basic-style>]=<regex>]
[sockurl[.<basic-style>]=<regex>]
[set=<setspec>]
[aci=<attrname>]
<access> ::= [self]{<level>|<priv>}
<level> ::= none | disclose | auth | compare | search | read | write | manage
<priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+
<control> ::= [stop | continue | break]
</PRE>
<P>where the <what> part selects the entries and/or attributes to which the access applies, the <TT><who></TT> part specifies which entities are granted access, and the <TT><access></TT> part specifies the access granted. Multiple <TT><who> <access> <control></TT> triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the <EM>slapd.access</EM>(5) man page.</P>
<H3><A NAME="What to control access to">8.2.1. What to control access to</A></H3>
<P>The <what> part of an access specification determines the entries and attributes to which the access control applies. Entries are commonly selected in two ways: by DN and by filter. The following qualifiers select entries by DN:</P>
<PRE>
to *
to dn[.<basic-style>]=<regex>
to dn.<scope-style>=<DN>
</PRE>
<P>The first form is used to select all entries. The second form may be used to select entries by matching a regular expression against the target entry's <EM>normalized DN</EM>. (The second form is not discussed further in this document.) The third form is used to select entries which are within the requested scope of DN. The <DN> is a string representation of the Distinguished Name, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A>.</P>
<P>The scope can be either <TT>base</TT>, <TT>one</TT>, <TT>subtree</TT>, or <TT>children</TT>. Where <TT>base</TT> matches only the entry with provided DN, <TT>one</TT> matches the entries whose parent is the provided DN, <TT>subtree</TT> matches all entries in the subtree whose root is the provided DN, and <TT>children</TT> matches all entries under the DN (but not the entry named by the DN).</P>
<P>For example, if the directory contained entries named:</P>
<PRE>
0: o=suffix
1: cn=Manager,o=suffix
2: ou=people,o=suffix
3: uid=kdz,ou=people,o=suffix
4: cn=addresses,uid=kdz,ou=people,o=suffix
5: uid=hyc,ou=people,o=suffix
</PRE>
<P>Then:</P>
<UL>
<TT>dn.base="ou=people,o=suffix"</TT> match 2;
<BR>
<TT>dn.one="ou=people,o=suffix"</TT> match 3, and 5;
<BR>
<TT>dn.subtree="ou=people,o=suffix"</TT> match 2, 3, 4, and 5; and
<BR>
<TT>dn.children="ou=people,o=suffix"</TT> match 3, 4, and 5.</UL>
<P>Entries may also be selected using a filter:</P>
<PRE>
to filter=<ldap filter>
</PRE>
<P>where <ldap filter> is a string representation of an LDAP search filter, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A>. For example:</P>
<PRE>
to filter=(objectClass=person)
</PRE>
<P>Note that entries may be selected by both DN and filter by including both qualifiers in the <what> clause.</P>
<PRE>
to dn.one="ou=people,o=suffix" filter=(objectClass=person)
</PRE>
<P>Attributes within an entry are selected by including a comma-separated list of attribute names in the <what> selector:</P>
<PRE>
attrs=<attribute list>
</PRE>
<P>A specific value of an attribute is selected by using a single attribute name and also using a value selector:</P>
<PRE>
attrs=<attribute> val[.<style>]=<regex>
</PRE>
<P>There are two special <EM>pseudo</EM> attributes <TT>entry</TT> and <TT>children</TT>. To read (and hence return) a target entry, the subject must have <TT>read</TT> access to the target's <EM>entry</EM> attribute. To perform a search, the subject must have <TT>search</TT> access to the search base's <EM>entry</EM> attribute. To add or delete an entry, the subject must have <TT>write</TT> access to the entry's <TT>entry</TT> attribute AND must have <TT>write</TT> access to the entry's parent's <TT>children</TT> attribute. To rename an entry, the subject must have <TT>write</TT> access to entry's <TT>entry</TT> attribute AND have <TT>write</TT> access to both the old parent's and new parent's <TT>children</TT> attributes. The complete examples at the end of this section should help clear things up.</P>
<P>Lastly, there is a special entry selector <TT>"*"</TT> that is used to select any entry. It is used when no other <TT><what></TT> selector has been provided. It's equivalent to "<TT>dn=.*</TT>"</P>
<H3><A NAME="Who to grant access to">8.2.2. Who to grant access to</A></H3>
<P>The <who> part identifies the entity or entities being granted access. Note that access is granted to "entities" not "entries." The following table summarizes entity specifiers:</P>
<TABLE CLASS="columns" BORDER ALIGN='Center'>
<CAPTION ALIGN=top>Table 6.3: Access Entity Specifiers</CAPTION>
<TR CLASS="heading">
<TD>
<STRONG>Specifier</STRONG>
</TD>
<TD>
<STRONG>Entities</STRONG>
</TD>
</TR>
<TR>
<TD>
<TT>*</TT>
</TD>
<TD>
All, including anonymous and authenticated users
</TD>
</TR>
<TR>
<TD>
<TT>anonymous</TT>
</TD>
<TD>
Anonymous (non-authenticated) users
</TD>
</TR>
<TR>
<TD>
<TT>users</TT>
</TD>
<TD>
Authenticated users
</TD>
</TR>
<TR>
<TD>
<TT>self</TT>
</TD>
<TD>
User associated with target entry
</TD>
</TR>
<TR>
<TD>
<TT>dn[.<basic-style>]=<regex></TT>
</TD>
<TD>
Users matching a regular expression
</TD>
</TR>
<TR>
<TD>
<TT>dn.<scope-style>=<DN></TT>
</TD>
<TD>
Users within scope of a DN
</TD>
</TR>
</TABLE>
<P>The DN specifier behaves much like <what> clause DN specifiers.</P>
<P>Other control factors are also supported. For example, a <TT><who></TT> can be restricted by an entry listed in a DN-valued attribute in the entry to which the access applies:</P>
<PRE>
dnattr=<dn-valued attribute name>
</PRE>
<P>The dnattr specification is used to give access to an entry whose DN is listed in an attribute of the entry (e.g., give access to a group entry to whoever is listed as the owner of the group entry).</P>
<P>Some factors may not be appropriate in all environments (or any). For example, the domain factor relies on IP to domain name lookups. As these can easily be spoofed, the domain factor should be avoided.</P>
<H3><A NAME="The access to grant">8.2.3. The access to grant</A></H3>
<P>The kind of <access> granted can be one of the following:</P>
<TABLE CLASS="columns" BORDER ALIGN='Center'>
<CAPTION ALIGN=top>Table 6.4: Access Levels</CAPTION>
<TR CLASS="heading">
<TD ALIGN='Left'>
<STRONG>Level</STRONG>
</TD>
<TD ALIGN='Right'>
<STRONG>Privileges</STRONG>
</TD>
<TD ALIGN='Left'>
<STRONG>Description</STRONG>
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>none =</TT>
</TD>
<TD ALIGN='Right'>
<TT>0</TT>
</TD>
<TD ALIGN='Left'>
no access
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>disclose =</TT>
</TD>
<TD ALIGN='Right'>
<TT>d</TT>
</TD>
<TD ALIGN='Left'>
needed for information disclosure on error
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>auth =</TT>
</TD>
<TD ALIGN='Right'>
<TT>dx</TT>
</TD>
<TD ALIGN='Left'>
needed to authenticate (bind)
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>compare =</TT>
</TD>
<TD ALIGN='Right'>
<TT>cdx</TT>
</TD>
<TD ALIGN='Left'>
needed to compare
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>search =</TT>
</TD>
<TD ALIGN='Right'>
<TT>scdx</TT>
</TD>
<TD ALIGN='Left'>
needed to apply search filters
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>read =</TT>
</TD>
<TD ALIGN='Right'>
<TT>rscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to read search results
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>write =</TT>
</TD>
<TD ALIGN='Right'>
<TT>wrscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to modify/rename
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>manage =</TT>
</TD>
<TD ALIGN='Right'>
<TT>mwrscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to manage
</TD>
</TR>
</TABLE>
<P>Each level implies all lower levels of access. So, for example, granting someone <TT>write</TT> access to an entry also grants them <TT>read</TT>, <TT>search</TT>, <TT>compare</TT>, <TT>auth</TT> and <TT>disclose</TT> access. However, one may use the privileges specifier to grant specific permissions.</P>
<H3><A NAME="Access Control Evaluation">8.2.4. Access Control Evaluation</A></H3>
<P>When evaluating whether some requester should be given access to an entry and/or attribute, slapd compares the entry and/or attribute to the <TT><what></TT> selectors given in the configuration file. For each entry, access controls provided in the database which holds the entry (or the global access directives if not held in any database) apply first, followed by the global access directives. However, when dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P>
<P>Within this priority, access directives are examined in the order in which they appear in the config file. Slapd stops with the first <TT><what></TT> selector that matches the entry and/or attribute. The corresponding access directive is the one slapd will use to evaluate access.</P>
<P>Next, slapd compares the entity requesting access to the <TT><who></TT> selectors within the access directive selected above in the order in which they appear. It stops with the first <TT><who></TT> selector that matches the requester. This determines the access the entity requesting access has to the entry and/or attribute.</P>
<P>Finally, slapd compares the access granted in the selected <TT><access></TT> clause to the access requested by the client. If it allows greater or equal access, access is granted. Otherwise, access is denied.</P>
<P>The order of evaluation of access directives makes their placement in the configuration file important. If one access directive is more specific than another in terms of the entries it selects, it should appear first in the config file. Similarly, if one <TT><who></TT> selector is more specific than another it should come first in the access directive. The access control examples given below should help make this clear.</P>
<H3><A NAME="Access Control Examples">8.2.5. Access Control Examples</A></H3>
<P>The access control facility described above is quite powerful. This section shows some examples of its use for descriptive purposes.</P>
<P>A simple example:</P>
<PRE>
access to * by * read
</PRE>
<P>This access directive grants read access to everyone.</P>
<PRE>
access to *
by self write
by anonymous auth
by * read
</PRE>
<P>This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries. Note that only the first <TT>by <who></TT> clause which matches applies. Hence, the anonymous users are granted <TT>auth</TT>, not <TT>read</TT>. The last clause could just as well have been "<TT>by users read</TT>".</P>
<P>It is often desirable to restrict operations based upon the level of protection in place. The following shows how security strength factors (SSF) can be used.</P>
<PRE>
access to *
by ssf=128 self write
by ssf=64 anonymous auth
by ssf=64 users read
</PRE>
<P>This directive allows users to modify their own entries if security protections have of strength 128 or better have been established, allows authentication access to anonymous users, and read access when 64 or better security protections have been established. If client has not establish sufficient security protections, the implicit <TT>by * none</TT> clause would be applied.</P>
<P>The following example shows the use of a style specifiers to select the entries by DN in two access directives where ordering is significant.</P>
<PRE>
access to dn.children="dc=example,dc=com"
by * search
access to dn.children="dc=com"
by * read
</PRE>
<P>Read access is granted to entries under the <TT>dc=com</TT> subtree, except for those entries under the <TT>dc=example,dc=com</TT> subtree, to which search access is granted. No access is granted to <TT>dc=com</TT> as neither access directive matches this DN. If the order of these access directives was reversed, the trailing directive would never be reached, since all entries under <TT>dc=example,dc=com</TT> are also under <TT>dc=com</TT> entries.</P>
<P>Also note that if no <TT>access to</TT> directive matches or no <TT>by <who></TT> clause, <B>access is denied</B>. That is, every <TT>access to</TT> directive ends with an implicit <TT>by * none</TT> clause. When dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P>
<P>The next example again shows the importance of ordering, both of the access directives and the <TT>by <who></TT> clauses. It also shows the use of an attribute selector to grant access to a specific attribute and various <TT><who></TT> selectors.</P>
<PRE>
access to dn.subtree="dc=example,dc=com" attrs=homePhone
by self write
by dn.children="dc=example,dc=com" search
by peername.regex=IP=10\..+ read
access to dn.subtree="dc=example,dc=com"
by self write
by dn.children="dc=example,dc=com" search
by anonymous auth
</PRE>
<P>This example applies to entries in the "<TT>dc=example,dc=com</TT>" subtree. To all attributes except <TT>homePhone</TT>, an entry can write to itself, entries under <TT>example.com</TT> entries can search by them, anybody else has no access (implicit <TT>by * none</TT>) excepting for authentication/authorization (which is always done anonymously). The <TT>homePhone</TT> attribute is writable by the entry, searchable by entries under <TT>example.com</TT>, readable by clients connecting from network 10, and otherwise not readable (implicit <TT>by * none</TT>). All other access is denied by the implicit <TT>access to * by * none</TT>.</P>
<P>Sometimes it is useful to permit a particular DN to add or remove itself from an attribute. For example, if you would like to create a group and allow people to add and remove only their own DN from the member attribute, you could accomplish it with an access directive like this:</P>
<PRE>
access to attrs=member,entry
by dnattr=member selfwrite
</PRE>
<P>The dnattr <TT><who></TT> selector says that the access applies to entries listed in the <TT>member</TT> attribute. The <TT>selfwrite</TT> access selector says that such members can only add or delete their own DN from the attribute, not other values. The addition of the entry attribute is required because access to the entry is required to access any of the entry's attributes.</P>
<HR>
<H2><A NAME="Access Control via Dynamic Configuration">8.3. Access Control via Dynamic Configuration</A></H2>
<P>Access to slapd entries and attributes is controlled by the olcAccess attribute, whose values are a sequence of access directives. The general form of the olcAccess configuration is:</P>
<PRE>
olcAccess: <access directive>
<access directive> ::= to <what>
[by <who> [<access>] [<control>] ]+
<what> ::= * |
[dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
[filter=<ldapfilter>] [attrs=<attrlist>]
<basic-style> ::= regex | exact
<scope-style> ::= base | one | subtree | children
<attrlist> ::= <attr> [val[.<basic-style>]=<regex>] | <attr> , <attrlist>
<attr> ::= <attrname> | entry | children
<who> ::= * | [anonymous | users | self
| dn[.<basic-style>]=<regex> | dn.<scope-style>=<DN>]
[dnattr=<attrname>]
[group[/<objectclass>[/<attrname>][.<basic-style>]]=<regex>]
[peername[.<basic-style>]=<regex>]
[sockname[.<basic-style>]=<regex>]
[domain[.<basic-style>]=<regex>]
[sockurl[.<basic-style>]=<regex>]
[set=<setspec>]
[aci=<attrname>]
<access> ::= [self]{<level>|<priv>}
<level> ::= none | disclose | auth | compare | search | read | write | manage
<priv> ::= {=|+|-}{m|w|r|s|c|x|d|0}+
<control> ::= [stop | continue | break]
</PRE>
<P>where the <what> part selects the entries and/or attributes to which the access applies, the <TT><who></TT> part specifies which entities are granted access, and the <TT><access></TT> part specifies the access granted. Multiple <TT><who> <access> <control></TT> triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the <EM>slapd.access</EM>(5) man page.</P>
<H3><A NAME="What to control access to">8.3.1. What to control access to</A></H3>
<P>The <what> part of an access specification determines the entries and attributes to which the access control applies. Entries are commonly selected in two ways: by DN and by filter. The following qualifiers select entries by DN:</P>
<PRE>
to *
to dn[.<basic-style>]=<regex>
to dn.<scope-style>=<DN>
</PRE>
<P>The first form is used to select all entries. The second form may be used to select entries by matching a regular expression against the target entry's <EM>normalized DN</EM>. (The second form is not discussed further in this document.) The third form is used to select entries which are within the requested scope of DN. The <DN> is a string representation of the Distinguished Name, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4514.txt">RFC4514</A>.</P>
<P>The scope can be either <TT>base</TT>, <TT>one</TT>, <TT>subtree</TT>, or <TT>children</TT>. Where <TT>base</TT> matches only the entry with provided DN, <TT>one</TT> matches the entries whose parent is the provided DN, <TT>subtree</TT> matches all entries in the subtree whose root is the provided DN, and <TT>children</TT> matches all entries under the DN (but not the entry named by the DN).</P>
<P>For example, if the directory contained entries named:</P>
<PRE>
0: o=suffix
1: cn=Manager,o=suffix
2: ou=people,o=suffix
3: uid=kdz,ou=people,o=suffix
4: cn=addresses,uid=kdz,ou=people,o=suffix
5: uid=hyc,ou=people,o=suffix
</PRE>
<P>Then:</P>
<UL>
<TT>dn.base="ou=people,o=suffix"</TT> match 2;
<BR>
<TT>dn.one="ou=people,o=suffix"</TT> match 3, and 5;
<BR>
<TT>dn.subtree="ou=people,o=suffix"</TT> match 2, 3, 4, and 5; and
<BR>
<TT>dn.children="ou=people,o=suffix"</TT> match 3, 4, and 5.</UL>
<P>Entries may also be selected using a filter:</P>
<PRE>
to filter=<ldap filter>
</PRE>
<P>where <ldap filter> is a string representation of an LDAP search filter, as described in <A HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC4515</A>. For example:</P>
<PRE>
to filter=(objectClass=person)
</PRE>
<P>Note that entries may be selected by both DN and filter by including both qualifiers in the <what> clause.</P>
<PRE>
to dn.one="ou=people,o=suffix" filter=(objectClass=person)
</PRE>
<P>Attributes within an entry are selected by including a comma-separated list of attribute names in the <what> selector:</P>
<PRE>
attrs=<attribute list>
</PRE>
<P>A specific value of an attribute is selected by using a single attribute name and also using a value selector:</P>
<PRE>
attrs=<attribute> val[.<style>]=<regex>
</PRE>
<P>There are two special <EM>pseudo</EM> attributes <TT>entry</TT> and <TT>children</TT>. To read (and hence return) a target entry, the subject must have <TT>read</TT> access to the target's <EM>entry</EM> attribute. To perform a search, the subject must have <TT>search</TT> access to the search base's <EM>entry</EM> attribute. To add or delete an entry, the subject must have <TT>write</TT> access to the entry's <TT>entry</TT> attribute AND must have <TT>write</TT> access to the entry's parent's <TT>children</TT> attribute. To rename an entry, the subject must have <TT>write</TT> access to entry's <TT>entry</TT> attribute AND have <TT>write</TT> access to both the old parent's and new parent's <TT>children</TT> attributes. The complete examples at the end of this section should help clear things up.</P>
<P>Lastly, there is a special entry selector <TT>"*"</TT> that is used to select any entry. It is used when no other <TT><what></TT> selector has been provided. It's equivalent to "<TT>dn=.*</TT>"</P>
<H3><A NAME="Who to grant access to">8.3.2. Who to grant access to</A></H3>
<P>The <who> part identifies the entity or entities being granted access. Note that access is granted to "entities" not "entries." The following table summarizes entity specifiers:</P>
<TABLE CLASS="columns" BORDER ALIGN='Center'>
<CAPTION ALIGN=top>Table 5.3: Access Entity Specifiers</CAPTION>
<TR CLASS="heading">
<TD>
<STRONG>Specifier</STRONG>
</TD>
<TD>
<STRONG>Entities</STRONG>
</TD>
</TR>
<TR>
<TD>
<TT>*</TT>
</TD>
<TD>
All, including anonymous and authenticated users
</TD>
</TR>
<TR>
<TD>
<TT>anonymous</TT>
</TD>
<TD>
Anonymous (non-authenticated) users
</TD>
</TR>
<TR>
<TD>
<TT>users</TT>
</TD>
<TD>
Authenticated users
</TD>
</TR>
<TR>
<TD>
<TT>self</TT>
</TD>
<TD>
User associated with target entry
</TD>
</TR>
<TR>
<TD>
<TT>dn[.<basic-style>]=<regex></TT>
</TD>
<TD>
Users matching a regular expression
</TD>
</TR>
<TR>
<TD>
<TT>dn.<scope-style>=<DN></TT>
</TD>
<TD>
Users within scope of a DN
</TD>
</TR>
</TABLE>
<P>The DN specifier behaves much like <what> clause DN specifiers.</P>
<P>Other control factors are also supported. For example, a <TT><who></TT> can be restricted by an entry listed in a DN-valued attribute in the entry to which the access applies:</P>
<PRE>
dnattr=<dn-valued attribute name>
</PRE>
<P>The dnattr specification is used to give access to an entry whose DN is listed in an attribute of the entry (e.g., give access to a group entry to whoever is listed as the owner of the group entry).</P>
<P>Some factors may not be appropriate in all environments (or any). For example, the domain factor relies on IP to domain name lookups. As these can easily be spoofed, the domain factor should be avoided.</P>
<H3><A NAME="The access to grant">8.3.3. The access to grant</A></H3>
<P>The kind of <access> granted can be one of the following:</P>
<TABLE CLASS="columns" BORDER ALIGN='Center'>
<CAPTION ALIGN=top>Table 5.4: Access Levels</CAPTION>
<TR CLASS="heading">
<TD ALIGN='Left'>
<STRONG>Level</STRONG>
</TD>
<TD ALIGN='Right'>
<STRONG>Privileges</STRONG>
</TD>
<TD ALIGN='Left'>
<STRONG>Description</STRONG>
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>none</TT>
</TD>
<TD ALIGN='Right'>
<TT>=0</TT>
</TD>
<TD ALIGN='Left'>
no access
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>disclose</TT>
</TD>
<TD ALIGN='Right'>
<TT>=d</TT>
</TD>
<TD ALIGN='Left'>
needed for information disclosure on error
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>auth</TT>
</TD>
<TD ALIGN='Right'>
<TT>=dx</TT>
</TD>
<TD ALIGN='Left'>
needed to authenticate (bind)
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>compare</TT>
</TD>
<TD ALIGN='Right'>
<TT>=cdx</TT>
</TD>
<TD ALIGN='Left'>
needed to compare
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>search</TT>
</TD>
<TD ALIGN='Right'>
<TT>=scdx</TT>
</TD>
<TD ALIGN='Left'>
needed to apply search filters
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>read</TT>
</TD>
<TD ALIGN='Right'>
<TT>=rscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to read search results
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>write</TT>
</TD>
<TD ALIGN='Right'>
<TT>=wrscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to modify/rename
</TD>
</TR>
<TR>
<TD ALIGN='Left'>
<TT>manage</TT>
</TD>
<TD ALIGN='Right'>
<TT>=mwrscdx</TT>
</TD>
<TD ALIGN='Left'>
needed to manage
</TD>
</TR>
</TABLE>
<P>Each level implies all lower levels of access. So, for example, granting someone <TT>write</TT> access to an entry also grants them <TT>read</TT>, <TT>search</TT>, <TT>compare</TT>, <TT>auth</TT> and <TT>disclose</TT> access. However, one may use the privileges specifier to grant specific permissions.</P>
<H3><A NAME="Access Control Evaluation">8.3.4. Access Control Evaluation</A></H3>
<P>When evaluating whether some requester should be given access to an entry and/or attribute, slapd compares the entry and/or attribute to the <TT><what></TT> selectors given in the configuration. For each entry, access controls provided in the database which holds the entry (or the global access directives if not held in any database) apply first, followed by the global access directives (which are held in the <TT>frontend</TT> database definition). However, when dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P>
<P>Within this priority, access directives are examined in the order in which they appear in the configuration attribute. Slapd stops with the first <TT><what></TT> selector that matches the entry and/or attribute. The corresponding access directive is the one slapd will use to evaluate access.</P>
<P>Next, slapd compares the entity requesting access to the <TT><who></TT> selectors within the access directive selected above in the order in which they appear. It stops with the first <TT><who></TT> selector that matches the requester. This determines the access the entity requesting access has to the entry and/or attribute.</P>
<P>Finally, slapd compares the access granted in the selected <TT><access></TT> clause to the access requested by the client. If it allows greater or equal access, access is granted. Otherwise, access is denied.</P>
<P>The order of evaluation of access directives makes their placement in the configuration file important. If one access directive is more specific than another in terms of the entries it selects, it should appear first in the configuration. Similarly, if one <TT><who></TT> selector is more specific than another it should come first in the access directive. The access control examples given below should help make this clear.</P>
<H3><A NAME="Access Control Examples">8.3.5. Access Control Examples</A></H3>
<P>The access control facility described above is quite powerful. This section shows some examples of its use for descriptive purposes.</P>
<P>A simple example:</P>
<PRE>
olcAccess: to * by * read
</PRE>
<P>This access directive grants read access to everyone.</P>
<PRE>
olcAccess: to *
by self write
by anonymous auth
by * read
</PRE>
<P>This directive allows the user to modify their entry, allows anonymous to authenticate against these entries, and allows all others to read these entries. Note that only the first <TT>by <who></TT> clause which matches applies. Hence, the anonymous users are granted <TT>auth</TT>, not <TT>read</TT>. The last clause could just as well have been "<TT>by users read</TT>".</P>
<P>It is often desirable to restrict operations based upon the level of protection in place. The following shows how security strength factors (SSF) can be used.</P>
<PRE>
olcAccess: to *
by ssf=128 self write
by ssf=64 anonymous auth
by ssf=64 users read
</PRE>
<P>This directive allows users to modify their own entries if security protections of strength 128 or better have been established, allows authentication access to anonymous users, and read access when strength 64 or better security protections have been established. If the client has not establish sufficient security protections, the implicit <TT>by * none</TT> clause would be applied.</P>
<P>The following example shows the use of style specifiers to select the entries by DN in two access directives where ordering is significant.</P>
<PRE>
olcAccess: to dn.children="dc=example,dc=com"
by * search
olcAccess: to dn.children="dc=com"
by * read
</PRE>
<P>Read access is granted to entries under the <TT>dc=com</TT> subtree, except for those entries under the <TT>dc=example,dc=com</TT> subtree, to which search access is granted. No access is granted to <TT>dc=com</TT> as neither access directive matches this DN. If the order of these access directives was reversed, the trailing directive would never be reached, since all entries under <TT>dc=example,dc=com</TT> are also under <TT>dc=com</TT> entries.</P>
<P>Also note that if no <TT>olcAccess: to</TT> directive matches or no <TT>by <who></TT> clause, <B>access is denied</B>. When dealing with an access list, because the global access list is effectively appended to each per-database list, if the resulting list is non-empty then the access list will end with an implicit <TT>access to * by * none</TT> directive. If there are no access directives applicable to a backend, then a default read is used.</P>
<P>The next example again shows the importance of ordering, both of the access directives and the <TT>by <who></TT> clauses. It also shows the use of an attribute selector to grant access to a specific attribute and various <TT><who></TT> selectors.</P>
<PRE>
olcAccess: to dn.subtree="dc=example,dc=com" attrs=homePhone
by self write
by dn.children=dc=example,dc=com" search
by peername.regex=IP=10\..+ read
olcAccess: to dn.subtree="dc=example,dc=com"
by self write
by dn.children="dc=example,dc=com" search
by anonymous auth
</PRE>
<P>This example applies to entries in the "<TT>dc=example,dc=com</TT>" subtree. To all attributes except <TT>homePhone</TT>, an entry can write to itself, entries under <TT>example.com</TT> entries can search by them, anybody else has no access (implicit <TT>by * none</TT>) excepting for authentication/authorization (which is always done anonymously). The <TT>homePhone</TT> attribute is writable by the entry, searchable by entries under <TT>example.com</TT>, readable by clients connecting from network 10, and otherwise not readable (implicit <TT>by * none</TT>). All other access is denied by the implicit <TT>access to * by * none</TT>.</P>
<P>Sometimes it is useful to permit a particular DN to add or remove itself from an attribute. For example, if you would like to create a group and allow people to add and remove only their own DN from the member attribute, you could accomplish it with an access directive like this:</P>
<PRE>
olcAccess: to attrs=member,entry
by dnattr=member selfwrite
</PRE>
<P>The dnattr <TT><who></TT> selector says that the access applies to entries listed in the <TT>member</TT> attribute. The <TT>selfwrite</TT> access selector says that such members can only add or delete their own DN from the attribute, not other values. The addition of the entry attribute is required because access to the entry is required to access any of the entry's attributes.</P>
<H3><A NAME="Access Control Ordering">8.3.6. Access Control Ordering</A></H3>
<P>Since the ordering of <TT>olcAccess</TT> directives is essential to their proper evaluation, but LDAP attributes normally do not preserve the ordering of their values, OpenLDAP uses a custom schema extension to maintain a fixed ordering of these values. This ordering is maintained by prepending a <TT>"{X}"</TT> numeric index to each value, similarly to the approach used for ordering the configuration entries. These index tags are maintained automatically by slapd and do not need to be specified when originally defining the values. For example, when you create the settings</P>
<PRE>
olcAccess: to attrs=member,entry
by dnattr=member selfwrite
olcAccess: to dn.children="dc=example,dc=com"
by * search
olcAccess: to dn.children="dc=com"
by * read
</PRE>
<P>when you read them back using slapcat or ldapsearch they will contain</P>
<PRE>
olcAccess: {0}to attrs=member,entry
by dnattr=member selfwrite
olcAccess: {1}to dn.children="dc=example,dc=com"
by * search
olcAccess: {2}to dn.children="dc=com"
by * read
</PRE>
<P>The numeric index may be used to specify a particular value to change when using ldapmodify to edit the access rules. This index can be used instead of (or in addition to) the actual access value. Using this numeric index is very helpful when multiple access rules are being managed.</P>
<P>For example, if we needed to change the second rule above to grant write access instead of search, we could try this LDIF:</P>
<PRE>
changetype: modify
delete: olcAccess
olcAccess: to dn.children="dc=example,dc=com" by * search
-
add: olcAccess
olcAccess: to dn.children="dc=example,dc=com" by * write
-
</PRE>
<P>But this example <B>will not</B> guarantee that the existing values remain in their original order, so it will most likely yield a broken security configuration. Instead, the numeric index should be used:</P>
<PRE>
changetype: modify
delete: olcAccess
olcAccess: {1}
-
add: olcAccess
olcAccess: {1}to dn.children="dc=example,dc=com" by * write
-
</PRE>
<P>This example deletes whatever rule is in value #1 of the <TT>olcAccess</TT> attribute (regardless of its value) and adds a new value that is explicitly inserted as value #1. The result will be</P>
<PRE>
olcAccess: {0}to attrs=member,entry
by dnattr=member selfwrite
olcAccess: {1}to dn.children="dc=example,dc=com"
by * write
olcAccess: {2}to dn.children="dc=com"
by * read
</PRE>
<P>which is exactly what was intended.</P>
<HR>
<H2><A NAME="Access Control Common Examples">8.4. Access Control Common Examples</A></H2>
<H3><A NAME="Basic ACLs">8.4.1. Basic ACLs</A></H3>
<P>Generally one should start with some basic ACLs such as:</P>
<PRE>
access to attrs=userPassword
by self =xw
by anonymous auth
by * none
access to *
by self write
by users read
by * none
</PRE>
<P>The first ACL allows users to update (but not read) their passwords, anonymous users to authenticate against this attribute, and (implicitly) denying all access to others.</P>
<P>The second ACL allows users full access to their entry, authenticated users read access to anything, and (implicitly) denying all access to others (in this case, anonymous users).</P>
<H3><A NAME="Matching Anonymous and Authenticated users">8.4.2. Matching Anonymous and Authenticated users</A></H3>
<P>An anonymous user has a empty DN. While the <EM>dn.exact=""</EM> or <EM>dn.regex="^$"</EM> could be used, <EM>slapd</EM>(8)) offers an anonymous shorthand which should be used instead.</P>
<PRE>
access to *
by anonymous none
by * read
</PRE>
<P>denies all access to anonymous users while granting others read.</P>
<P>Authenticated users have a subject DN. While <EM>dn.regex=".+"</EM> will match any authenticated user, OpenLDAP provides the users short hand which should be used instead.</P>
<PRE>
access to *
by users read
by * none
</PRE>
<P>This ACL grants read permissions to authenticated users while denying others (i.e.: anonymous users).</P>
<H3><A NAME="Controlling rootdn access">8.4.3. Controlling rootdn access</A></H3>
<P>You could specify the <EM>rootdn</EM> in <EM>slapd.conf</EM>(5) or <EM>slapd.d</EM> without specifying a <EM>rootpw</EM>. Then you have to add an actual directory entry with the same dn, e.g.:</P>
<PRE>
dn: cn=Manager,o=MyOrganization
cn: Manager
sn: Manager
objectClass: person
objectClass: top
userPassword: {SSHA}someSSHAdata
</PRE>
<P>Then binding as the <EM>rootdn</EM> will require a regular bind to that DN, which in turn requires auth access to that entry's DN and <EM>userPassword</EM>, and this can be restricted via ACLs. E.g.:</P>
<PRE>
access to dn.base="cn=Manager,o=MyOrganization"
by peername.regex=127\.0\.0\.1 auth
by peername.regex=192\.168\.0\..* auth
by users none
by * none
</PRE>
<P>The ACLs above will only allow binding using rootdn from localhost and 192.168.0.0/24.</P>
<H3><A NAME="Managing access with Groups">8.4.4. Managing access with Groups</A></H3>
<P>There are a few ways to do this. One approach is illustrated here. Consider the following DIT layout:</P>
<PRE>
+-dc=example,dc=com
+---cn=administrators,dc=example,dc=com
+---cn=fred blogs,dc=example,dc=com
</PRE>
<P>and the following group object (in LDIF format):</P>
<PRE>
dn: cn=administrators,dc=example,dc=com
cn: administrators of this region
objectclass: groupOfNames (important for the group acl feature)
member: cn=fred blogs,dc=example,dc=com
member: cn=somebody else,dc=example,dc=com
</PRE>
<P>One can then grant access to the members of this this group by adding appropriate <EM>by group</EM> clause to an access directive in <EM>slapd.conf</EM>(5). For instance,</P>
<PRE>
access to dn.children="dc=example,dc=com"
by self write
by group.exact="cn=Administrators,dc=example,dc=com" write
by * auth
</PRE>
<P>Like by <EM>dn</EM> clauses, one can also use <EM>expand</EM> to expand the group name based upon the regular expression matching of the target, that is, the to <EM>dn.regex</EM>). For instance,</P>
<PRE>
access to dn.regex="(.+,)?ou=People,(dc=[^,]+,dc=[^,]+)$"
attrs=children,entry,uid
by group.expand="cn=Managers,$2" write
by users read
by * auth
</PRE>
<P>The above illustration assumed that the group members are to be found in the <EM>member</EM> attribute type of the <EM>groupOfNames</EM> object class. If you need to use a different group object and/or a different attribute type then use the following <EM>slapd.conf</EM>(5) (abbreviated) syntax:</P>
<PRE>
access to <what>
by group/<objectclass>/<attributename>=<DN> <access>
</PRE>
<P>For example:</P>
<PRE>
access to *
by group/organizationalRole/roleOccupant="cn=Administrator,dc=example,dc=com" write
</PRE>
<P>In this case, we have an ObjectClass <EM>organizationalRole</EM> which contains the administrator DN's in the <EM>roleOccupant</EM> attribute. For instance:</P>
<PRE>
dn: cn=Administrator,dc=example,dc=com
cn: Administrator
objectclass: organizationalRole
roleOccupant: cn=Jane Doe,dc=example,dc=com
</PRE>
<P><HR WIDTH="80%" ALIGN="Left">
<STRONG>Note: </STRONG>the specified member attribute type MUST be of DN or <EM>NameAndOptionalUID</EM> syntax, and the specified object class SHOULD allow the attribute type.
<HR WIDTH="80%" ALIGN="Left"></P>
<P>Dynamic Groups are also supported in Access Control. Please see <EM>slapo-dynlist</EM>(5) and the <A HREF="overlays.html#Dynamic Lists">Dynamic Lists</A> overlay section.</P>
<H3><A NAME="Granting access to a subset of attributes">8.4.5. Granting access to a subset of attributes</A></H3>
<P>You can grant access to a set of attributes by specifying a list of attribute names in the ACL <EM>to</EM> clause. To be useful, you also need to grant access to the <EM>entry</EM> itself. Also note how <EM>children</EM> controls the ability to add, delete, and rename entries.</P>
<PRE>
# mail: self may write, authenticated users may read
access to attrs=mail
by self write
by users read
by * none
# cn, sn: self my write, all may read
access to attrs=cn,sn
by self write
by * read
# immediate children: only self can add/delete entries under this entry
access to attrs=children
by self write
# entry itself: self may write, all may read
access to attrs=entry
by self write
by * read
# other attributes: self may write, others have no access
access to *
by self write
by * none
</PRE>
<P>ObjectClass names may also be specified in this list, which will affect all the attributes that are required and/or allowed by that <EM>objectClass</EM>. Actually, names in <EM>attrlist</EM> that are prefixed by <EM>@</EM> are directly treated as objectClass names. A name prefixed by <EM>!</EM> is also treated as an objectClass, but in this case the access rule affects the attributes that are not required nor allowed by that <EM>objectClass</EM>.</P>
<H3><A NAME="Allowing a user write to all entries below theirs">8.4.6. Allowing a user write to all entries below theirs</A></H3>
<P>For a setup where a user can write to its own record and to all of its children:</P>
<PRE>
access to dn.regex="(.+,)?(uid=[^,]+,o=Company)$"
by dn.exact,expand="$2" write
by anonymous auth
</PRE>
<P>(Add more examples for above)</P>
<H3><A NAME="Allowing entry creation">8.4.7. Allowing entry creation</A></H3>
<P>Let's say, you have it like this:</P>
<PRE>
o=<basedn>
ou=domains
associatedDomain=<somedomain>
ou=users
uid=<someuserid>
uid=<someotheruserid>
ou=addressbooks
uid=<someuserid>
cn=<someone>
cn=<someoneelse>
</PRE>
<P>and, for another domain <someotherdomain>:</P>
<PRE>
o=<basedn>
ou=domains
associatedDomain=<someotherdomain>
ou=users
uid=<someuserid>
uid=<someotheruserid>
ou=addressbooks
uid=<someotheruserid>
cn=<someone>
cn=<someoneelse>
</PRE>
<P>then, if you wanted user <EM>uid=<someuserid></EM> to <B>ONLY</B> create an entry for its own thing, you could write an ACL like this:</P>
<PRE>
# this rule lets users of "associatedDomain=<matcheddomain>"
# write under "ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>",
# i.e. a user can write ANY entry below its domain's address book;
# this permission is necessary, but not sufficient, the next
# will restrict this permission further
access to dn.regex="^ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" attrs=children
by dn.regex="^uid=([^,]+),ou=users,associatedDomain=$1,ou=domains,o=<basedn>$$" write
by * none
# Note that above the "by" clause needs a "regex" style to make sure
# it expands to a DN that starts with a "uid=<someuserid>" pattern
# while substituting the associatedDomain submatch from the "what" clause.
# This rule lets a user with "uid=<matcheduid>" of "<associatedDomain=matcheddomain>"
# write (i.e. add, modify, delete) the entry whose DN is exactly
# "uid=<matcheduid>,ou=addressbook,associatedDomain=<matcheddomain>,ou=domains,o=<basedn>"
# and ANY entry as subtree of it
access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$"
by dn.exact,expand="uid=$2,ou=users,associatedDomain=$3,ou=domains,o=<basedn>" write
by * none
# Note that above the "by" clause uses the "exact" style with the "expand"
# modifier because now the whole pattern can be rebuilt by means of the
# submatches from the "what" clause, so a "regex" compilation and evaluation
# is no longer required.
</PRE>
<H3><A NAME="Tips for using regular expressions in Access Control">8.4.8. Tips for using regular expressions in Access Control</A></H3>
<P>Always use <EM>dn.regex=<pattern></EM> when you intend to use regular expression matching. <EM>dn=<pattern></EM> alone defaults to <EM>dn.exact<pattern></EM>.</P>
<P>Use <EM>(.+)</EM> instead of <EM>(.*)</EM> when you want at least one char to be matched. <EM>(.*)</EM> matches the empty string as well.</P>
<P>Don't use regular expressions for matches that can be done otherwise in a safer and cheaper manner. Examples:</P>
<PRE>
dn.regex=".*dc=example,dc=com"
</PRE>
<P>is unsafe and expensive:</P>
<UL>
<LI>unsafe because any string containing <EM>dc=example,dc=com </EM>will match, not only those that end with the desired pattern; use <EM>.*dc=example,dc=com$</EM> instead.
<LI>unsafe also because it would allow any <EM>attributeType</EM> ending with <EM>dc</EM> as naming attribute for the first RDN in the string, e.g. a custom attributeType <EM>mydc</EM> would match as well. If you really need a regular expression that allows just <EM>dc=example,dc=com</EM> or any of its subtrees, use <EM>^(.+,)?dc=example,dc=com$</EM>, which means: anything to the left of dc=..., if any (the question mark after the pattern within brackets), must end with a comma;
<LI>expensive because if you don't need submatches, you could use scoping styles, e.g.</UL>
<PRE>
dn.subtree="dc=example,dc=com"
</PRE>
<P>to include <EM>dc=example,dc=com</EM> in the matching patterns,</P>
<PRE>
dn.children="dc=example,dc=com"
</PRE>
<P>to exclude <EM>dc=example,dc=com</EM> from the matching patterns, or</P>
<PRE>
dn.onelevel="dc=example,dc=com"
</PRE>
<P>to allow exactly one sublevel matches only.</P>
<P>Always use <EM>^</EM> and <EM>$</EM> in regexes, whenever appropriate, because <EM>ou=(.+),ou=(.+),ou=addressbooks,o=basedn</EM> will match <EM>something=bla,ou=xxx,ou=yyy,ou=addressbooks,o=basedn,ou=addressbooks,o=basedn,dc=some,dc=org</EM></P>
<P>Always use <EM>([^,]+)</EM> to indicate exactly one RDN, because <EM>(.+)</EM> can include any number of RDNs; e.g. <EM>ou=(.+),dc=example,dc=com</EM> will match <EM>ou=My,o=Org,dc=example,dc=com</EM>, which might not be what you want.</P>
<P>Never add the rootdn to the by clauses. ACLs are not even processed for operations performed with rootdn identity (otherwise there would be no reason to define a rootdn at all).</P>
<P>Use shorthands. The user directive matches authenticated users and the anonymous directive matches anonymous users.</P>
<P>Don't use the <EM>dn.regex</EM> form for <by> clauses if all you need is scoping and/or substring replacement; use scoping styles (e.g. <EM>exact</EM>, <EM>onelevel</EM>, <EM>children</EM> or <EM>subtree</EM>) and the style modifier expand to cause substring expansion.</P>
<P>For instance,</P>
<PRE>
access to dn.regex=".+,dc=([^,]+),dc=([^,]+)$"
by dn.regex="^[^,],ou=Admin,dc=$1,dc=$2$$" write
</PRE>
<P>although correct, can be safely and efficiently replaced by</P>
<PRE>
access to dn.regex=".+,(dc=[^,]+,dc=[^,]+)$"
by dn.onelevel,expand="ou=Admin,$1" write
</PRE>
<P>where the regex in the <EM><what></EM> clause is more compact, and the one in the <EM><by></EM> clause is replaced by a much more efficient scoping style of onelevel with substring expansion.</P>
<H3><A NAME="Granting and Denying access based on security strength factors (ssf)">8.4.9. Granting and Denying access based on security strength factors (ssf)</A></H3>
<P>You can restrict access based on the security strength factor (SSF)</P>
<PRE>
access to dn="cn=example,cn=edu"
by * ssf=256 read
</PRE>
<P>0 (zero) implies no protection, 1 implies integrity protection only, 56 DES or other weak ciphers, 112 triple DES and other strong ciphers, 128 RC4, Blowfish and other modern strong ciphers.</P>
<P>Other possibilities:</P>
<PRE>
transport_ssf=<n>
tls_ssf=<n>
sasl_ssf=<n>
</PRE>
<P>256 is recommended.</P>
<P>See <EM>slapd.conf</EM>(5) for information on <EM>ssf</EM>.</P>
<H3><A NAME="When things aren\'t working as expected">8.4.10. When things aren't working as expected</A></H3>
<P>Consider this example:</P>
<PRE>
access to *
by anonymous auth
access to *
by self write
access to *
by users read
</PRE>
<P>You may think this will allow any user to login, to read everything and change his own data if he is logged in. But in this example only the login works and an ldapsearch returns no data. The Problem is that SLAPD goes through its access config line by line and stops as soon as it finds a match in the part of the access rule.(here: <EM>to *</EM>)</P>
<P>To get what we wanted the file has to read:</P>
<PRE>
access to *
by anonymous auth
by self write
by users read
</PRE>
<P>The general rule is: "special access rules first, generic access rules last"</P>
<P>See also <EM>slapd.access</EM>(5), loglevel 128 and <EM>slapacl</EM>(8) for debugging information.</P>
<HR>
<H2><A NAME="Sets - Granting rights based on relationships">8.5. Sets - Granting rights based on relationships</A></H2>
<P>Sets are best illustrated via examples. The following sections will present a few set ACL examples in order to facilitate their understanding.</P>
<P>(Sets in Access Controls FAQ Entry: <A HREF="http://www.openldap.org/faq/data/cache/1133.html">http://www.openldap.org/faq/data/cache/1133.html</A>)</P>
<P><HR WIDTH="80%" ALIGN="Left">
<STRONG>Note: </STRONG>Sets are considered experimental.
<HR WIDTH="80%" ALIGN="Left"></P>
<H3><A NAME="Groups of Groups">8.5.1. Groups of Groups</A></H3>
<P>The OpenLDAP ACL for groups doesn't expand groups within groups, which are groups that have another group as a member. For example:</P>
<PRE>
dn: cn=sudoadm,ou=group,dc=example,dc=com
cn: sudoadm
objectClass: groupOfNames
member: uid=john,ou=people,dc=example,dc=com
member: cn=accountadm,ou=group,dc=example,dc=com
dn: cn=accountadm,ou=group,dc=example,dc=com
cn: accountadm
objectClass: groupOfNames
member: uid=mary,ou=people,dc=example,dc=com
</PRE>
<P>If we use standard group ACLs with the above entries and allow members of the <TT>sudoadm</TT> group to write somewhere, <TT>mary</TT> won't be included:</P>
<PRE>
access to dn.subtree="ou=sudoers,dc=example,dc=com"
by group.exact="cn=sudoadm,ou=group,dc=example,dc=com" write
by * read
</PRE>
<P>With sets we can make the ACL be recursive and consider group within groups. So for each member that is a group, it is further expanded:</P>
<PRE>
access to dn.subtree="ou=sudoers,dc=example,dc=com"
by set="[cn=sudoadm,ou=group,dc=example,dc=com]/member* & user" write
by * read
</PRE>
<P>This set ACL means: take the <TT>cn=sudoadm</TT> DN, check its <TT>member</TT> attribute(s) (where the "<TT>*</TT>" means recursively) and intersect the result with the authenticated user's DN. If the result is non-empty, the ACL is considered a match and write access is granted.</P>
<P>The following drawing explains how this set is built:</P>
<P><CENTER><IMG SRC="set-recursivegroup.png" ALIGN="center"></CENTER></P>
<P ALIGN="Center">Figure X.Y: Populating a recursive group set</P>
<P>First we get the <TT>uid=john</TT> DN. This entry doesn't have a <TT>member</TT> attribute, so the expansion stops here. Now we get to <TT>cn=accountadm</TT>. This one does have a <TT>member</TT> attribute, which is <TT>uid=mary</TT>. The <TT>uid=mary</TT> entry, however, doesn't have member, so we stop here again. The end comparison is:</P>
<PRE>
{"uid=john,ou=people,dc=example,dc=com","uid=mary,ou=people,dc=example,dc=com"} & user
</PRE>
<P>If the authenticated user's DN is any one of those two, write access is granted. So this set will include <TT>mary</TT> in the <TT>sudoadm</TT> group and she will be allowed the write access.</P>
<H3><A NAME="Group ACLs without DN syntax">8.5.2. Group ACLs without DN syntax</A></H3>
<P>The traditional group ACLs, and even the previous example about recursive groups, require that the members are specified as DNs instead of just usernames.</P>
<P>With sets, however, it's also possible to use simple names in group ACLs, as this example will show.</P>
<P>Let's say we want to allow members of the <TT>sudoadm</TT> group to write to the <TT>ou=suders</TT> branch of our tree. But our group definition now is using <TT>memberUid</TT> for the group members:</P>
<PRE>
dn: cn=sudoadm,ou=group,dc=example,dc=com
cn: sudoadm
objectClass: posixGroup
gidNumber: 1000
memberUid: john
</PRE>
<P>With this type of group, we can't use group ACLs. But with a set ACL we can grant the desired access:</P>
<PRE>
access to dn.subtree="ou=sudoers,dc=example,dc=com"
by set="[cn=sudoadm,ou=group,dc=example,dc=com]/memberUid & user/uid" write
by * read
</PRE>
<P>We use a simple intersection where we compare the <TT>uid</TT> attribute of the connecting (and authenticated) user with the <TT>memberUid</TT> attributes of the group. If they match, the intersection is non-empty and the ACL will grant write access.</P>
<P>This drawing illustrates this set when the connecting user is authenticated as <TT>uid=john,ou=people,dc=example,dc=com</TT>:</P>
<P><CENTER><IMG SRC="set-memberUid.png" ALIGN="center"></CENTER></P>
<P ALIGN="Center">Figure X.Y: Sets with <TT>memberUid</TT></P>
<P>In this case, it's a match. If it were <TT>mary</TT> authenticating, however, she would be denied write access to <TT>ou=sudoers</TT> because her <TT>uid</TT> attribute is not listed in the group's <TT>memberUid</TT>.</P>
<H3><A NAME="Following references">8.5.3. Following references</A></H3>
<P>We will now show a quite powerful example of what can be done with sets. This example tends to make OpenLDAP administrators smile after they have understood it and its implications.</P>
<P>Let's start with an user entry:</P>
<PRE>
dn: uid=john,ou=people,dc=example,dc=com
uid: john
objectClass: inetOrgPerson
givenName: John
sn: Smith
cn: john
manager: uid=mary,ou=people,dc=example,dc=com
</PRE>
<P>Writing an ACL to allow the manager to update some attributes is quite simple using sets:</P>
<PRE>
access to dn.exact="uid=john,ou=people,dc=example,dc=com"
attrs=carLicense,homePhone,mobile,pager,telephoneNumber
by self write
by set="this/manager & user" write
by * read
</PRE>
<P>In that set, <TT>this</TT> expands to the entry being accessed, so that <TT>this/manager</TT> expands to <TT>uid=mary,ou=people,dc=example,dc=com</TT> when john's entry is accessed. If the manager herself is accessing John's entry, the ACL will match and write access to those attributes will be granted.</P>
<P>So far, this same behavior can be obtained with the <TT>dnattr</TT> keyword. With sets, however, we can further enhance this ACL. Let's say we want to allow the secretary of the manager to also update these attributes. This is how we do it:</P>
<PRE>
access to dn.exact="uid=john,ou=people,dc=example,dc=com"
attrs=carLicense,homePhone,mobile,pager,telephoneNumber
by self write
by set="this/manager & user" write
by set="this/manager/secretary & user" write
by * read
</PRE>
<P>Now we need a picture to help explain what is happening here (entries shortened for clarity):</P>
<P><CENTER><IMG SRC="set-following-references.png" ALIGN="center"></CENTER></P>
<P ALIGN="Center">Figure X.Y: Sets jumping through entries</P>
<P>In this example, Jane is the secretary of Mary, which is the manager of John. This whole relationship is defined with the <TT>manager</TT> and <TT>secretary</TT> attributes, which are both of the distinguishedName syntax (i.e., full DNs). So, when the <TT>uid=john</TT> entry is being accessed, the <TT>this/manager/secretary</TT> set becomes <TT>{"uid=jane,ou=people,dc=example,dc=com"</TT>} (follow the references in the picture):</P>
<PRE>
this = [uid=john,ou=people,dc=example,dc=com]
this/manager = \
[uid=john,ou=people,dc=example,dc=com]/manager = uid=mary,ou=people,dc=example,dc=com
this/manager/secretary = \
[uid=mary,ou=people,dc=example,dc=com]/secretary = uid=jane,ou=people,dc=example,dc=com
</PRE>
<P>The end result is that when Jane accesses John's entry, she will be granted write access to the specified attributes. Better yet, this will happen to any entry she accesses which has Mary as the manager.</P>
<P>This is all cool and nice, but perhaps gives too much power to secretaries. Maybe we need to further restrict it. For example, let's only allow executive secretaries to have this power:</P>
<PRE>
access to dn.exact="uid=john,ou=people,dc=example,dc=com"
attrs=carLicense,homePhone,mobile,pager,telephoneNumber
by self write
by set="this/manager & user" write
by set="this/manager/secretary &
[cn=executive,ou=group,dc=example,dc=com]/member* &
user" write
by * read
</PRE>
<P>It's almost the same ACL as before, but we now also require that the connecting user be a member of the (possibly nested) <TT>cn=executive</TT> group.</P>
<P></P>
</DIV>
<DIV CLASS="footer">
<HR>
<DIV CLASS="navigate">
<P ALIGN="Center"><A HREF="index.html">Contents</A> | <A HREF="index.html">Parent Topic</A> | <A HREF="runningslapd.html">Previous Topic</A> | <A HREF="limits.html">Next Topic</A> <BR><A HREF="http://www.openldap.org/">Home</A> | <A HREF="../index.html">Catalog</A></P>
</DIV>
<P>
<FONT COLOR="#808080" FACE="Arial,Verdana,Helvetica" SIZE="1"><B>
________________<BR>
<SMALL>© Copyright 2011, <A HREF="http://www.OpenLDAP.org/foundation/">OpenLDAP Foundation</A>, <A HREF="mailto:info@OpenLDAP.org">info@OpenLDAP.org</A></SMALL></B></FONT>
</DIV>
</BODY>
</HTML>
