Access questions

[Ori Bani <oribani@gmail.com>]

Hello,

I think I understand that default access for everything that does not
have any access rule is to allow read permission to everyone.  All
other entries (that have some form of access rules) will have a
default of "access to * by * none" applied.  I'd like instead to have
all defaults be no access.

I have a directory that will be used for internal email processes and
also have a certain amount of public/anonymous access (but only to
chosen attributes).  Due to the public/anonymous component, I'd like
to have default access rules be as restrictive as possible.

Does it make sense to (do people commonly) set a global access of
"access to * by * none" and then open access up for individual
databases as desired?

I'm thinking a global rule:

access to *
     by dn.base="cn=Manager,dc=example,dc=com" write
     by * none

Then each database will have to explicitly open access only as much as needed.


The following would be in the database that uses the suffix for
dc=example,dc=com

Passwords for auth only, only admin can change passwords:

access to attrs=userPassword
     by dn.base="cn=Manager,dc=example,dc=com" write
     by anonymous auth
     by * none

Attributes needed by email delivery software only visible to the entry itself:

access to attrs=mailMessageStore,homeDirectory,uidNumber,gidNumber
     by dn.base="cn=Manager,dc=example,dc=com" write
     by self read
     by * none

Publicly available attributes defined explicitly:

access to attrs=mail,jpegPhoto
     by dn.base="cn=Manager,dc=example,dc=com" write
     by * read

Nothing else can be seen by anyone except the admin:

access to *
     by dn.base="cn=Manager,dc=example,dc=com" write
     by * none


In this scenario, cn is used to identify entries when searching but as
you see, that attribute is forbidden to anonymous. Is that a problem
or is it OK to allow query against cn while still disallowing cn in
the results?


I guess I'd also add this within this database's context, but I have
to do it above the other rules I just listed?

access to dn.base="cn=Manager,dc=example,dc=com"
     by peername.ip=127.0.0.1 auth
     by peername.ip=192.168.0.0%255.255.255.0 auth
     by * none

Any tips much appreciated.