ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

The ACL Stack
Access control for objects and attributes is managed through the
construction of a stack of access control lists. The first matching
rule applies and subsequent rules do not apply, thus order is
extremely important.
Access Control List syntax:
access to
by < compare | search | read | write >
If a dn matching pattern is not included the rule applies to the
attributes listed in all the objects in the DSA not previously
matched by a dn regular expression.
The special attribute children grants modification privilages
(create, delete) to an objects children. The special attribute entry
control is used to grant privilage to modify the object itself (delete).