SUSE LINUX Documentation - Index of

428 Reference
are appended to this directive. Information can be found in the included OpenLDAP
documentation.
Example 25.3 slapd.conf: pidfile and argsfile
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
These two files contain the PID (process ID) and some of the arguments with which
the slapd process is started. There is no need for modifications here.
Example 25.4 slapd.conf: Access Control
# Sample Access Control
# Allow read access of root DSE
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# access to dn="" by * read
access to * by self write
by users read
by anonymous auth
#
# if no access controls are present, the default is:
# Allow read by all
#
# rootdn can always write!
Example 25.4, “slapd.conf: Access Control” (page 428) is the excerpt from slapd
.conf that regulates the access permissions for the LDAP directory on the server. The
settings made here in the global section of slapd.conf are valid as long as no custom
access rules are declared in the database-specific section. These would overwrite the
global declarations. As presented here, all users have read access to the directory, but
only the administrator (rootdn) can write to this directory. Access control regulation
in LDAP is a highly complex process. The following tips can help:
• Every access rule has the following structure:
access to by
• what is a placeholder for the object or attribute to which access is granted. Individual
directory branches can be protected explicitly with separate rules. It is also
possible to process regions of the directory tree with one rule by using regular expressions.
slapd evaluates all rules in the order in which they are listed in the
configuration file. More general rules should be listed after more specific ones—the
first rule slapd regards as valid is evaluated and all following entries are ignored.