ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

OpenLDAPaci: Rights
The rights field in an OpenLDAPaci value is a semicolon (";")
delimited list of values.
ACTION;PERMISSION;TARGET
ACTION : grant is the only value that has any real meaning. You can
specifiy deny, but how ACI's are processed makes it rather pointless.
deny is always assumed when no value matches.
PERMISSION : A comma delimited list of values where
r = read s = compare w = write c = compare
TARGET : Is a comma delimited list of values where
attribute = an attribute name, example: userPassword
[all] = all atributes of object
[entry] = the object itself but no attributes
[children] = subordinate objectes.