openldap/templates/mandriva-dit-access.conf

# mandriva-dit-access.conf

limits group="cn=LDAP Replicators,ou=System Groups,dc=mageia,dc=org"
        limit size=unlimited
        limit time=unlimited

limits group="cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org"
        limit size=unlimited
        limit time=unlimited

limits group="cn=Account Admins,ou=System Groups,dc=mageia,dc=org"
        limit size=unlimited
        limit time=unlimited

# so we don't have to add these to every other acl down there
access to dn.subtree="dc=mageia,dc=org"
        by group.exact="cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org" write
        by group.exact="cn=LDAP Replicators,ou=System Groups,dc=mageia,dc=org" read
        by * break

# userPassword access
# Allow account registration to write userPassword of unprivileged users accounts
access to dn.subtree="ou=People,dc=mageia,dc=org" 
        filter="(&(objectclass=inetOrgPerson)(!(objectclass=posixAccount)))"
        attrs=userPassword,pwdReset
        by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" +a
        by * +0 break

# shadowLastChange is here because it needs to be writable by the user because
# of pam_ldap, which will update this attr whenever the password is changed.
# And this is done with the user's credentials
access to dn.subtree="dc=mageia,dc=org"
        attrs=shadowLastChange
        by self write
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read
access to dn.subtree="dc=mageia,dc=org"
        attrs=userPassword
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by self write
        by anonymous auth
        by * none

# kerberos key access
# "by auth" just in case...
access to dn.subtree="dc=mageia,dc=org"
        attrs=krb5Key
        by self write
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by anonymous auth
        by * none

# password policies
access to dn.subtree="ou=Password Policies,dc=mageia,dc=org"
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# samba password attributes
# by self not strictly necessary, because samba uses its own admin user to
# change the password on the user's behalf
# openldap also doesn't auth on these attributes, but maybe some day it will
access to dn.subtree="dc=mageia,dc=org"
        attrs=sambaLMPassword,sambaNTPassword
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by anonymous auth
        by self write
        by * none
# password history attribute
# pwdHistory is read-only, but ACL is simplier with it here
access to dn.subtree="dc=mageia,dc=org"
        attrs=sambaPasswordHistory,pwdHistory
        by self read
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * none

# pwdReset, so the admin can force an user to change a password
access to dn.subtree="dc=mageia,dc=org"
        attrs=pwdReset,pwdAccountLockedTime
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# group owner can add/remove/edit members to groups
access to dn.regex="^cn=[^,]+,ou=(System Groups|Group),dc=mageia,dc=org$"
        attrs=member
        by dnattr=owner write
        by * break

# let the user change some of his/her attributes
access to dn.subtree="ou=People,dc=mageia,dc=org"
        attrs=carLicense,homePhone,homePostalAddress,mobile,pager,telephoneNumber,mail,preferredLanguage
        by self write
        by * break

# create new accounts
access to dn.regex="^([^,]+,)?ou=(People|Group|Hosts),dc=mageia,dc=org$"
        attrs=children,entry
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * break
# access to existing entries
access to dn.regex="^[^,]+,ou=(People|Hosts|Group),dc=mageia,dc=org$"
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * break

# sambaDomainName entry
access to dn.regex="^(sambaDomainName=[^,]+,)?dc=mageia,dc=org$"
        attrs=children,entry,@sambaDomain,@sambaUnixIdPool
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# samba ID mapping
access to dn.regex="^(sambaSID=[^,]+,)?ou=Idmap,dc=mageia,dc=org$"
        attrs=children,entry,@sambaIdmapEntry
        by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
        by group.exact="cn=IDMAP Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# global address book
# XXX - which class(es) to use?
access to dn.regex="^(.*,)?ou=Address Book,dc=mageia,dc=org"
        attrs=children,entry,@inetOrgPerson,@evolutionPerson,@evolutionPersonList
        by group.exact="cn=Address Book Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# dhcp entries
# XXX - open up read access to anybody?
access to dn.sub="ou=dhcp,dc=mageia,dc=org"
        attrs=children,entry,@dhcpService,@dhcpServer,@dhcpSharedNetwork,@dhcpSubnet,@dhcpPool,@dhcpGroup,@dhcpHost,@dhcpClass,@dhcpSubClass,@dhcpOptions,@dhcpLeases,@dhcpLog
        by group.exact="cn=DHCP Admins,ou=System Groups,dc=mageia,dc=org" write
        by group.exact="cn=DHCP Readers,ou=System Groups,dc=mageia,dc=org" read
        by * read

# sudoers
access to dn.regex="^([^,]+,)?ou=sudoers,dc=mageia,dc=org$"
        attrs=children,entry,@sudoRole
        by group.exact="cn=Sudo Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# dns
access to dn="ou=dns,dc=mageia,dc=org"
        attrs=entry,@extensibleObject
        by group.exact="cn=DNS Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read
access to dn.sub="ou=dns,dc=mageia,dc=org"
        attrs=children,entry,@dNSZone
        by group.exact="cn=DNS Admins,ou=System Groups,dc=mageia,dc=org" write
        by group.exact="cn=DNS Readers,ou=System Groups,dc=mageia,dc=org" read
        by * none

# registration - allow registrar group to create basic unprivileged accounts
access to dn.subtree="ou=People,dc=mageia,dc=org" 
        attrs="objectClass" 
        val="inetOrgperson" 
        by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" write by * +0 break

access to dn.subtree="ou=People,dc=mageia,dc=org" 
        attrs="cn,sn,gn,mail,entry,children" 
        by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" +a break
        by * +0 break

# MTA
# XXX - what else can we add here? Virtual Domains? With which schema?
access to dn.one="ou=People,dc=mageia,dc=org"
        attrs=@inetLocalMailRecipient,mail
        by group.exact="cn=MTA Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# KDE Configuration
access to dn.sub="ou=KDEConfig,dc=mageia,dc=org"
        by group.exact="cn=KDEConfig Admins,ou=System Groups,dc=mageia,dc=org" write
        by * read

# last one
access to dn.subtree="dc=mageia,dc=org" attrs=entry,uid,cn
        by * read

1	misc	53	# mandriva-dit-access.conf
2
3			limits group="cn=LDAP Replicators,ou=System Groups,dc=mageia,dc=org"
4			limit size=unlimited
5			limit time=unlimited
6
7			limits group="cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org"
8			limit size=unlimited
9			limit time=unlimited
10
11			limits group="cn=Account Admins,ou=System Groups,dc=mageia,dc=org"
12			limit size=unlimited
13			limit time=unlimited
14
15			# so we don't have to add these to every other acl down there
16			access to dn.subtree="dc=mageia,dc=org"
17			by group.exact="cn=LDAP Admins,ou=System Groups,dc=mageia,dc=org" write
18			by group.exact="cn=LDAP Replicators,ou=System Groups,dc=mageia,dc=org" read
19			by * break
20
21			# userPassword access
22	buchan	82	# Allow account registration to write userPassword of unprivileged users accounts
23			access to dn.subtree="ou=People,dc=mageia,dc=org"
24			filter="(&(objectclass=inetOrgPerson)(!(objectclass=posixAccount)))"
25			attrs=userPassword,pwdReset
26			by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" +a
27			by * +0 break
28
29	misc	53	# shadowLastChange is here because it needs to be writable by the user because
30			# of pam_ldap, which will update this attr whenever the password is changed.
31			# And this is done with the user's credentials
32			access to dn.subtree="dc=mageia,dc=org"
33			attrs=shadowLastChange
34			by self write
35			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
36			by * read
37			access to dn.subtree="dc=mageia,dc=org"
38			attrs=userPassword
39			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
40			by self write
41			by anonymous auth
42			by * none
43
44			# kerberos key access
45			# "by auth" just in case...
46			access to dn.subtree="dc=mageia,dc=org"
47			attrs=krb5Key
48			by self write
49			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
50			by anonymous auth
51			by * none
52
53			# password policies
54			access to dn.subtree="ou=Password Policies,dc=mageia,dc=org"
55			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
56			by * read
57
58			# samba password attributes
59			# by self not strictly necessary, because samba uses its own admin user to
60			# change the password on the user's behalf
61			# openldap also doesn't auth on these attributes, but maybe some day it will
62			access to dn.subtree="dc=mageia,dc=org"
63			attrs=sambaLMPassword,sambaNTPassword
64			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
65			by anonymous auth
66			by self write
67			by * none
68			# password history attribute
69			# pwdHistory is read-only, but ACL is simplier with it here
70			access to dn.subtree="dc=mageia,dc=org"
71			attrs=sambaPasswordHistory,pwdHistory
72			by self read
73			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
74			by * none
75
76			# pwdReset, so the admin can force an user to change a password
77			access to dn.subtree="dc=mageia,dc=org"
78	buchan	82	attrs=pwdReset,pwdAccountLockedTime
79	misc	53	by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
80			by * read
81
82			# group owner can add/remove/edit members to groups
83			access to dn.regex="^cn=[^,]+,ou=(System Groups\|Group),dc=mageia,dc=org$"
84			attrs=member
85			by dnattr=owner write
86			by * break
87
88			# let the user change some of his/her attributes
89			access to dn.subtree="ou=People,dc=mageia,dc=org"
90	buchan	82	attrs=carLicense,homePhone,homePostalAddress,mobile,pager,telephoneNumber,mail,preferredLanguage
91	misc	53	by self write
92			by * break
93
94			# create new accounts
95			access to dn.regex="^([^,]+,)?ou=(People\|Group\|Hosts),dc=mageia,dc=org$"
96			attrs=children,entry
97			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
98			by * break
99			# access to existing entries
100			access to dn.regex="^[^,]+,ou=(People\|Hosts\|Group),dc=mageia,dc=org$"
101			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
102			by * break
103
104			# sambaDomainName entry
105			access to dn.regex="^(sambaDomainName=[^,]+,)?dc=mageia,dc=org$"
106			attrs=children,entry,@sambaDomain,@sambaUnixIdPool
107			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
108			by * read
109
110			# samba ID mapping
111			access to dn.regex="^(sambaSID=[^,]+,)?ou=Idmap,dc=mageia,dc=org$"
112			attrs=children,entry,@sambaIdmapEntry
113			by group.exact="cn=Account Admins,ou=System Groups,dc=mageia,dc=org" write
114			by group.exact="cn=IDMAP Admins,ou=System Groups,dc=mageia,dc=org" write
115			by * read
116
117			# global address book
118			# XXX - which class(es) to use?
119			access to dn.regex="^(.*,)?ou=Address Book,dc=mageia,dc=org"
120			attrs=children,entry,@inetOrgPerson,@evolutionPerson,@evolutionPersonList
121			by group.exact="cn=Address Book Admins,ou=System Groups,dc=mageia,dc=org" write
122			by * read
123
124			# dhcp entries
125			# XXX - open up read access to anybody?
126			access to dn.sub="ou=dhcp,dc=mageia,dc=org"
127			attrs=children,entry,@dhcpService,@dhcpServer,@dhcpSharedNetwork,@dhcpSubnet,@dhcpPool,@dhcpGroup,@dhcpHost,@dhcpClass,@dhcpSubClass,@dhcpOptions,@dhcpLeases,@dhcpLog
128			by group.exact="cn=DHCP Admins,ou=System Groups,dc=mageia,dc=org" write
129			by group.exact="cn=DHCP Readers,ou=System Groups,dc=mageia,dc=org" read
130			by * read
131
132			# sudoers
133			access to dn.regex="^([^,]+,)?ou=sudoers,dc=mageia,dc=org$"
134			attrs=children,entry,@sudoRole
135			by group.exact="cn=Sudo Admins,ou=System Groups,dc=mageia,dc=org" write
136			by * read
137
138			# dns
139			access to dn="ou=dns,dc=mageia,dc=org"
140			attrs=entry,@extensibleObject
141			by group.exact="cn=DNS Admins,ou=System Groups,dc=mageia,dc=org" write
142			by * read
143			access to dn.sub="ou=dns,dc=mageia,dc=org"
144			attrs=children,entry,@dNSZone
145			by group.exact="cn=DNS Admins,ou=System Groups,dc=mageia,dc=org" write
146			by group.exact="cn=DNS Readers,ou=System Groups,dc=mageia,dc=org" read
147			by * none
148
149	buchan	82	# registration - allow registrar group to create basic unprivileged accounts
150			access to dn.subtree="ou=People,dc=mageia,dc=org"
151			attrs="objectClass"
152			val="inetOrgperson"
153			by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" write by * +0 break
154
155			access to dn.subtree="ou=People,dc=mageia,dc=org"
156			attrs="cn,sn,gn,mail,entry,children"
157			by group/groupOfNames/member.exact="cn=registrars,ou=system groups,dc=mageia,dc=org" +a break
158			by * +0 break
159
160	misc	53	# MTA
161			# XXX - what else can we add here? Virtual Domains? With which schema?
162			access to dn.one="ou=People,dc=mageia,dc=org"
163			attrs=@inetLocalMailRecipient,mail
164			by group.exact="cn=MTA Admins,ou=System Groups,dc=mageia,dc=org" write
165			by * read
166
167			# KDE Configuration
168			access to dn.sub="ou=KDEConfig,dc=mageia,dc=org"
169			by group.exact="cn=KDEConfig Admins,ou=System Groups,dc=mageia,dc=org" write
170			by * read
171
172			# last one
173			access to dn.subtree="dc=mageia,dc=org" attrs=entry,uid,cn
174			by * read
175