Understanding default permissions in 389-DS

U. Windl

1/23/24, 12:21 PM

Importing an LDIF from an OpenLDAP server and examining the ACIs found, I don't really understand how default permissions are established:

I only found these two ACIs (LDIF unfolded):

dn: oid=1.3.6.1.4.1.4203.1.9.1.1,cn=features,cn=config
objectClass: top
objectClass: directoryServerFeature
oid: 1.3.6.1.4.1.4203.1.9.1.1
cn: Sync Request Control
aci: (targetattr != "aci")(version 3.0; acl "Sync Request Control"; allow( read, search ) userdn = "ldap:///all";)

dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
objectClass: top
objectClass: directoryServerFeature
oid: 2.16.840.1.113730.3.4.9
cn: VLV Request Control
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
createTimestamp: 20221121142915Z
modifyTimestamp: 20221121142915Z
aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow( read, search, compare, proxy ) userdn = "ldap:///all";)

I'm unsure what those two actually do.

Specifically I found no ACI at the "suffix root" (e.g. dc=example,dc=com). However at the root I found the "rootdse anon read access" ACI that seems to allow searching everything except aci attributes.

As I understand ACIs od 389-DS, with no other ACIs found in the "suffix tree", those at the root should matter. Am I expected to add specific ACIs within the "suffix root"? If so, what would be a typical "starting set"?

109

0 + 0

access-control-list

389-ds

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Understanding default permissions in 389-DS

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.