ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

OpenLDAPaci
The value of an OpenLDAPaci attribute is actually a hash/pound
("#") delimited list of five values:
OID#SCOPE#RIGHTS#TYPE#SUBJECT
So an OpenLDAPaci attribute might look like:
OpenLDAPaci: 1#entry#grant;r,w;[all]#group#cn=cis,ou=Groups,dc=Example,dc=Com
Obviously these can get really ugly really fast. ACI entries are
meant to be managed programatically, not by hand.
The first value (OID) is currently ignored.
The second value (SCOPE) is always entry with current versions.
Additional values with special meaning (specifying inheritance,
etc...) may be supported in later releases.