ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

children & entry
The ability to create or delete objectes beneath a point in the Dit,
typically an organizational unit object, is granted by providing a bind
write access to the object's children psuedo-attribute.
The ability to modify an object itself is granted via write access to the
object's entry psuedo-attribute.
The example below permits members of the Human Resources and CIS Dept
groups to create and remove objects beneath the People organizational unit:
access to dn="ou=People,dc=Whitemice,dc=Org"
attrs=children,entry
by group/groupOfUniqueNames/uniquemember="cn=Human Resources,ou=ACLGroups,dc=Whitemice,dc=Org" write
by group/groupOfUniqueNames/uniquemember="cn=CIS Dept,ou=ACLGroups,dc=Whitemice,dc=Org" write
by anonymous read
by * read