[DIRSERVER-1895] ACLs have no effect

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.0-M15
• Component/s: aci
• Labels: acl
• Environment: FreeBSD 9.1-RELEASE-p6
• Assignee: Unassigned
• Reporter: Christian Felsing
• Created: 03/Sep/13 15:54
• Updated: 28/Jun/19 06:34

Description

Following ACL does not what I expected:

{
identificationTag "mtaAclElement",
precedence 0,
authenticationLevel simple,
itemOrUserFirst userFirst:
{
userClasses
{
name

{ "cn=mta,dc=ip6,dc=li" }

}
,
userPermissions
{
{
protectedItems
{
entry,
attributeType

{ tsnetDomainName, tsnetMailHost, uid }

}
,
grantsAndDenials

{ grantBrowse, grantRead, grantReturnDN, grantCompare }

}
}
}
}

This ACL should allow DN cn=mta,dc=ip6,dc=li access to attributes
uid
tsnetDomainName
tsnetMailHost
and to list all DN entries. A test (temporary allow to list all
attributes) proved that this ACL matches.

but
ldapsearch -H ldap://192.168.116.29:10389 -x -D "cn=mta,dc=ip6,dc=li" -w
VerySecretPassword -b "dc=ip6,dc=li"

lists DN entries only:

1. [e-mail], freemail, ip6.li
   dn: uid=[e-mail],ou=freemail,dc=ip6,dc=li
   ...

Attributes listed on attributeType are not shown.