openldap/tests/data/slapd-acl.conf

# $OpenLDAP$
#
# master slapd config -- for testing
#
ucdata-path	./ucdata
include ./schema/core.schema
include ./schema/cosine.schema
include ./schema/inetorgperson.schema
include ./schema/openldap.schema
include ./schema/nis.schema
pidfile     ./test-db/slapd.pid
argsfile    ./test-db/slapd.args

# global ACLs
access to dn.base="" attr=objectClass by users read
access to * by * read

modulepath      ../servers/slapd/back-@BACKEND@/
@MODULELOAD@

#######################################################################
# ldbm database definitions
#######################################################################

database	@BACKEND@
#ldbm#cachesize	0
suffix		"o=University of Michigan,c=US"
directory	./test-db
rootdn		"cn=Manager,o=University of Michigan,c=US"
rootpw		secret
#ldbm#index		objectClass	eq
#ldbm#index		cn,sn,uid	pres,eq,sub
#bdb#index		objectClass	eq
#bdb#index		cn,sn,uid	pres,eq,sub

#
# normal installations should protect root dse, cn=monitor, cn=subschema
#

access to dn="" by * read
access to dn.base="" by * read

access		to attr=objectclass
		by * =rsc stop

access		to filter="(objectclass=person)" attr=userpassword dn.subtree=""
		by anonymous auth
		by self write

access		to dn.children="ou=Alumni Association,ou=People,o=University of Michigan,c=US"
		by dn.regex=".+,o=University of Michigan,c=US" +c continue
		by dn.subtree="o=University of Michigan,c=US" +rs continue
		by * stop

access		to attr=member,uniquemember
		by dnattr=member selfwrite
		by dnattr=uniquemember selfwrite
		by * read

access to attr=member,uniquemember filter=(mail=*edu)
		by * read

access to filter="(&(objectclass=groupofnames)(objectClass=groupofuniquenames))"
		by dn.base="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US" =sc continue
		by dn.regex="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" +rw stop
		by * break

access		to dn.children="ou=Information Technology Division,ou=People,o=University of Michigan,c=US"
		by group/groupOfUniqueNames/uniqueMember.exact="cn=ITD Staff,ou=Groups,o=University of Michigan,c=US" write
		by * read

access	to filter="(name=X*Y*Z)"
		by * continue

# fall into global ACLs
Add OpenLDAP RCSid 1999-09-09 06:52:19 +08:00			`# $OpenLDAP$`
Initial revision 1998-08-09 08:43:13 +08:00			`#`
			`# master slapd config -- for testing`
			`#`
Bring UCdata infrastructure. 2000-09-04 07:48:35 +08:00			`ucdata-path ./ucdata`
New schema code is now the default. Use -DSLAPD_SCHEMA_COMPAT to use 1.x compatible schema (deprecated). 2000-05-30 00:39:16 +08:00			`include ./schema/core.schema`
			`include ./schema/cosine.schema`
			`include ./schema/inetorgperson.schema`
Fix minor error in error text handling Fix invalid structural object class chains in test schema 2001-12-20 07:41:31 +08:00			`include ./schema/openldap.schema`
Add initial support for modify/increment. No over/under flow detection. Currently discovered via a "feature", but should use a control. Start of a control made, but needs to be better integrated (with auto use in ldapmodify(1)). 2003-08-08 00:42:40 +08:00			`include ./schema/nis.schema`
Place the arg and pid files into the test-* directories. 1999-01-22 02:08:33 +08:00			`pidfile ./test-db/slapd.pid`
			`argsfile ./test-db/slapd.args`
Initial revision 1998-08-09 08:43:13 +08:00
Allow dn.base="" 2001-09-01 13:01:31 +08:00			`# global ACLs`
			`access to dn.base="" attr=objectClass by users read`
			`access to * by * read`

ITS#2401 support tests for dynamically loaded backends 2003-04-30 11:04:18 +08:00			`modulepath ../servers/slapd/back-@BACKEND@/`
			`@MODULELOAD@`

Initial revision 1998-08-09 08:43:13 +08:00			`#######################################################################`
			`# ldbm database definitions`
			`#######################################################################`

Hack test environment to support multiple backends using one set of slapd.conf files. 2000-10-02 06:46:52 +08:00			`database @BACKEND@`
Misc cleanup 2002-01-14 11:42:24 +08:00			`#ldbm#cachesize 0`
pretty DNs 2001-12-06 15:32:53 +08:00			`suffix "o=University of Michigan,c=US"`
Initial revision 1998-08-09 08:43:13 +08:00			`directory ./test-db`
pretty DNs 2001-12-06 15:32:53 +08:00			`rootdn "cn=Manager,o=University of Michigan,c=US"`
Initial revision 1998-08-09 08:43:13 +08:00			`rootpw secret`
Updates for back-bdb testing 2001-08-01 12:50:47 +08:00			`#ldbm#index objectClass eq`
			`#ldbm#index cn,sn,uid pres,eq,sub`
Add BDB index directives 2001-10-04 05:27:37 +08:00			`#bdb#index objectClass eq`
			`#bdb#index cn,sn,uid pres,eq,sub`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
Import experimental referral implementation from OPENLDAP_DEVEL_REFERRALS. Includes support for update referral for each replicated backend. Reworked replication test to use update referral. Includes major rewrite of response encoding codes (result.c). Includes reworked alias support and eliminates old suffix alias codes (can be emulated using named alias). Includes (untested) support for the Manage DSA IT control. Works in LDAPv2 world. Still testing in LDAPv3 world. Added default referral (test009) test. 1999-07-16 10:45:46 +08:00			`#`
Misc tweaks 2003-02-25 01:15:31 +08:00			`# normal installations should protect root dse, cn=monitor, cn=subschema`
Import experimental referral implementation from OPENLDAP_DEVEL_REFERRALS. Includes support for update referral for each replicated backend. Reworked replication test to use update referral. Includes major rewrite of response encoding codes (result.c). Includes reworked alias support and eliminates old suffix alias codes (can be emulated using named alias). Includes (untested) support for the Manage DSA IT control. Works in LDAPv2 world. Still testing in LDAPv3 world. Added default referral (test009) test. 1999-07-16 10:45:46 +08:00			`#`

More ACL to dn="" bug fixing... and add test006-acl check 2002-07-11 09:45:22 +08:00			`access to dn="" by * read`
			`access to dn.base="" by * read`

Initial revision 1998-08-09 08:43:13 +08:00			`access to attr=objectclass`
Add basic flow control tests 1999-10-22 05:23:43 +08:00			`by * =rsc stop`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
Add dn.subtree="" clause 2003-09-16 05:50:13 +08:00			`access to filter="(objectclass=person)" attr=userpassword dn.subtree=""`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00			`by anonymous auth`
Minor acl optimizations. 1999-10-22 02:48:16 +08:00			`by self write`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
pretty DNs 2001-12-06 15:32:53 +08:00			`access to dn.children="ou=Alumni Association,ou=People,o=University of Michigan,c=US"`
Partially test new ACL styles. 2000-06-13 11:24:12 +08:00			`by dn.regex=".+,o=University of Michigan,c=US" +c continue`
pretty DNs 2001-12-06 15:32:53 +08:00			`by dn.subtree="o=University of Michigan,c=US" +rs continue`
Add basic flow control tests 1999-10-22 05:23:43 +08:00			`by * stop`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
Add nameAndOptionalUID pretty routine... improves uniqueMember handling Should resolve ITS#2664. 2003-08-23 05:03:03 +08:00			`access to attr=member,uniquemember`
Initial revision 1998-08-09 08:43:13 +08:00			`by dnattr=member selfwrite`
Add nameAndOptionalUID pretty routine... improves uniqueMember handling Should resolve ITS#2664. 2003-08-23 05:03:03 +08:00			`by dnattr=uniquemember selfwrite`
Initial revision 1998-08-09 08:43:13 +08:00			`by * read`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
Add nameAndOptionalUID pretty routine... improves uniqueMember handling Should resolve ITS#2664. 2003-08-23 05:03:03 +08:00			`access to attr=member,uniquemember filter=(mail=*edu)`
Some cleanup 2002-03-24 09:55:11 +08:00			`by * read`

Add nameAndOptionalUID pretty routine... improves uniqueMember handling Should resolve ITS#2664. 2003-08-23 05:03:03 +08:00			`access to filter="(&(objectclass=groupofnames)(objectClass=groupofuniquenames))"`
Squash some whitespace in a DN. (trivial) 2001-12-07 09:54:53 +08:00			`by dn.base="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US" =sc continue`
Change ACL default style to exact (from regex) 2003-05-30 13:24:39 +08:00			`by dn.regex="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$" +rw stop`
Add basic flow control tests 1999-10-22 05:23:43 +08:00			`by * break`
unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH 1999-07-05 14:26:26 +08:00
Added group ACL tests 2002-09-13 23:04:04 +08:00			`access to dn.children="ou=Information Technology Division,ou=People,o=University of Michigan,c=US"`
Add nameAndOptionalUID pretty routine... improves uniqueMember handling Should resolve ITS#2664. 2003-08-23 05:03:03 +08:00			`by group/groupOfUniqueNames/uniqueMember.exact="cn=ITD Staff,ou=Groups,o=University of Michigan,c=US" write`
Added group ACL tests 2002-09-13 23:04:04 +08:00			`by * read`

Add some undefined assertion tests 2002-03-02 02:58:11 +08:00			`access to filter="(name=XYZ)"`
			`by * continue`

Allow dn.base="" 2001-09-01 13:01:31 +08:00			`# fall into global ACLs`