Hello,
Can I make a request that certain features of the access
control documentation are emphasized? I've wasted quite a
lot of time on this and some simple rules (which already
exist in the documentation) would have been really helpful.
These are:
8. Access Control
8.2. Access Control via Static Configuration
8.2.5. Access Control Examples
To all attributes except homePhone, an entry can write
to itself, entries under example.com entries can search
by them, anybody else has no access (implicit by * none)
excepting for authentication/authorization (which is
always done anonymously).
The fact that authentication is always done
anonymously, even if anonymous binds are disabled in the
configuration, is very important.
8.2.4. Access Control Evaluation
Slapd stops with the first <what> selector
that matches the entry and/or attribute.
This is also very important, as it explains
exactly how the access rules are processed.
The order of evaluation of access
directives makes their placement in the configuration
file important.
I don't think this is emphasized enough, as it is
critical to how the access rules are processed.
Also, some mention of the ACL log level
would be useful!
Thanks.
Tom