mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-21 03:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

clarify DN regex match quirks

Browse Source
This commit is contained in:
Pierangelo Masarati 2003-05-17 12:39:10 +00:00
parent 0f2bb9f027
commit 904f513028
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
doc/man/man5/slapd.access.5
View File

@ -425,6 +425,48 @@ or the (even more silly) example
.LP .LP
which grants everybody search and compare privileges, and adds read which grants everybody search and compare privileges, and adds read
privileges to authenticated clients. privileges to authenticated clients.
.SH CAVEATS
It is strongly recommended to explicitly use the most appropriate
DN
.BR style ,
for performance (avoid unrequired regex matching when
an exact match suffices) but also to avoid possible
misimplementations of the access rules.
In fact, a rule of the form
.LP
.nf
access to dn="dc=example,dc=com"
by ...
.fi
.LP
implies that all the subtree "dc=example,dc=com" matches, and the
match is done using a regex.
.LP
.nf
access to dn.subtree="dc=example,dc=com"
by ...
.fi
.LP
would be far more appropriate.
.LP
Another quirk is related to the
.B by
clause:
a rule of the form
.LP
.nf
access to *
by dn="cn=User,dc=example,dc=com" write
.fi
.LP
gives write access to every DN below "cn=User,dc=example,dc=com";
if only that DN should have write access, the correct rule would be
.LP
.nf
access to *
by dn.exact="cn=User,dc=example,dc=com" write
.fi
.LP
.SH FILES .SH FILES
.TP .TP
ETCDIR/slapd.conf ETCDIR/slapd.conf