1# provider slapd config -- for testing 2# $OpenLDAP$ 3## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4## 5## Copyright 1998-2021 The OpenLDAP Foundation. 6## All rights reserved. 7## 8## Redistribution and use in source and binary forms, with or without 9## modification, are permitted only as authorized by the OpenLDAP 10## Public License. 11## 12## A copy of this license is available in the file LICENSE in the 13## top-level directory of the distribution or, alternatively, at 14## <http://www.OpenLDAP.org/license.html>. 15 16include @SCHEMADIR@/core.schema 17include @SCHEMADIR@/cosine.schema 18include @SCHEMADIR@/inetorgperson.schema 19include @SCHEMADIR@/openldap.schema 20include @SCHEMADIR@/nis.schema 21pidfile @TESTDIR@/slapd.1.pid 22argsfile @TESTDIR@/slapd.1.args 23 24# global ACLs 25# 26# normal installations should protect root dse, cn=monitor, cn=subschema 27# 28 29access to dn.exact="" attrs=objectClass 30 by users read 31access to * 32 by * read 33 34#mod#modulepath ../servers/slapd/back-@BACKEND@/ 35#mod#moduleload back_@BACKEND@.la 36 37####################################################################### 38# database definitions 39####################################################################### 40 41database @BACKEND@ 42 43suffix "dc=example,dc=com" 44rootdn "cn=Manager,dc=example,dc=com" 45rootpw secret 46#~null~#directory @TESTDIR@/db.1.a 47#indexdb#index objectClass eq 48#indexdb#index cn,sn,uid pres,eq,sub 49#ndb#dbname db_1 50#ndb#include @DATADIR@/ndb.conf 51add_content_acl on 52#access to attrs=objectclass dn.subtree="dc=example,dc=com" 53access to attrs=objectclass 54 by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" add 55 by * =rsc stop 56 57#access to filter="(objectclass=person)" attrs=userpassword dn.subtree="dc=example,dc=com" 58access to filter="(objectclass=person)" attrs=userpassword 59 by anonymous auth 60 by self =wx 61 62access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" 63 attrs=cn val="Mark A Elliot" 64 by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 65 by * break 66 67access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" 68 attrs=cn val="Mark Elliot" 69 by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 70 by * break 71 72access to dn.exact="cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com" 73 attrs=cn 74 by * search 75 76access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" 77 attrs=cn val.regex="^John D.+" 78 by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 79 by * break 80 81access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" 82 attrs=cn val.regex="^Jonath.+" 83 by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 84 by * break 85 86access to dn.exact="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" 87 attrs=cn 88 by * search 89 90access to dn.onelevel="ou=Information Technology Division,ou=People,dc=example,dc=com" 91 filter="(cn=*Jensen)" 92 attrs=cn val.regex=".*Jensen$" 93 by dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 94 by dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" read 95 by * break 96 97access to dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" 98 attrs=cn 99 by * search 100 101access to dn.children="ou=Alumni Association,ou=People,dc=example,dc=com" 102 by dn.regex=".+,dc=example,dc=com" +c continue 103 by dn.subtree="dc=example,dc=com" +rs continue 104 by dn.children="dc=example,dc=com" +d continue 105 by * stop 106 107#access to attrs=member,uniquemember dn.subtree="dc=example,dc=com" 108access to attrs=member,uniquemember 109 by dn.exact="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" selfwrite 110 by dnattr=member selfwrite 111 by dnattr=uniquemember selfwrite 112 by * read 113 114#access to attrs=member,uniquemember filter="(mail=*com)" dn.subtree="dc=example,dc=com" 115access to attrs=member,uniquemember filter="(mail=*com)" 116 by * read 117 118#access to filter="(|(objectclass=groupofnames)(objectClass=groupofuniquenames))" dn.subtree="dc=example,dc=com" 119access to filter="(|(objectclass=groupofnames)(objectClass=groupofuniquenames))" 120 by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" =sc continue 121 by dn.regex="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com$" +rw stop 122 by * break 123 124access to dn.children="ou=Information Technology Division,ou=People,dc=example,dc=com" 125 by group/groupOfUniqueNames/uniqueMember.exact="cn=ITD Staff,ou=Groups,dc=example,dc=com" write 126 by * read 127 128access to dn.exact="cn=Alumni Assoc Staff,ou=Groups,dc=example,dc=com" 129 by set="[cn=Alumni Assoc Staff,ou=Groups,dc=example,dc=com]/member* & user" write 130 by * read 131 132#access to filter="(name=X*Y*Z)" dn.subtree="dc=example,dc=com" 133access to filter="(name=X*Y*Z)" 134 by * continue 135 136access to dn.subtree="ou=Add & Delete,dc=example,dc=com" 137 by dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" add 138 by dn.exact="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" delete 139 by dn.exact="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" write 140 by * read 141 142# fall into global ACLs 143 144database monitor 145