e56faab5b1
Allow users to change their own password, but nothing else (no search, no read, no write) This will only run when setting up the 389-dirsrv instance for the first time, this has been applied on barnard by editing the dn (see #128 (comment)) Closes #128
7 lines
363 B
Plaintext
7 lines
363 B
Plaintext
dn: ou=users,dc=kosmos,dc=org
|
|
objectClass: top
|
|
objectClass: organizationalUnit
|
|
ou: users
|
|
aci: (target="ldap:///dc=kosmos,dc=org") (version 3.0; acl "user-deny-all"; deny (all) userdn="ldap:///dc=kosmos,dc=org";)
|
|
aci: (target="ldap:///dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "user-write-own-password"; allow (write) userdn="ldap:///self";)
|