UCS 2.4 - Univention

– Using a concrete DN via dn.base, e.g., via
by dn.base="uid=database-admin,cn=users,dc=company,dc=com"
– Using a regular expression, e.g., via
by dn.regex="cn=.*,cn=dc,cn=computers,dc=company,dc=com"
7.4 Configuration of LDAP ACLs
• group can be used to set the permission for a member of a group. In addition, the object class of
the group object and the attribute must be specified, which identifies a member. A group permission
in UCS looks as follows:
by group/univentionGroup/uniqueMember="cn=Domain Admins,cn=groups,dc=company,dc=com"
• peername, sockname and domain allow the definition of the socket file name or the network origin
of the accessing user. Some examples:
by sockname="PATH=/var/run/slapd/ldapi"
by peername.ip=127.0.0.1
by domain.subtree=example.com
7.4.4 Definition of the permission on the objects
Each by directive is completed with the assigned permission. The rules are ordered hierarchically with
each following rule receiving all the privileges of its predecessor.
• none denies every access.
• disclose denies the access but still issues an error warning.
• auth limits access to authentication and authorisation requests.
• compare limits the access to compare operations.
• search limits the access to search requests.
• none allows read-only access.
• write allows write access.
7.4.5 Definition of the handling of further rules with applied rules
For each by directive there are three possibilities for controlling how further rules are handled:
• As standard the processing of further access rules is stopped when a rule applies. This can also be
fixed explicitly using a stop directive.
• continue allows the processing of further permission rules within an access rule.
• break checks further access rules to see whether they apply.
185