On 11/14/25 9:43 PM, William Brown wrote:
On 13 Nov 2025, at 01:21, Jonathan Buzzard via 389-users
<[email protected]> wrote:
aci:
(target="ldap:///ou=people,dc=example,dc=com";)(targetattr="shadowExpire")(version3.0;
acl "aci for shadowExpire"; allow(read)
userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";;)
No space between version and 3.0.
That's all I can see that's wrong here.
I think your target selector is wrong too, because that means "only on
the exact object named ou=people,dc=... " where you probably want
target="ldap:///uid=*,ou=people,dc=example,dc=com";.
Actually the target is fine, it is supposed to be the parent. It's the
bind rule (userdn=) that narrows the scope.
And William is right, you just need a space between "version" and "3.0":
dn: dc=example,dc=com
changetype: modify
add: aci
aci:
(target="ldap:///ou=people,dc=example,dc=com";)(targetattr="shadowExpire")(version
3.0; acl "aci for shadowExpire"; allow(read)
userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";;)
modifying entry "dc=example,dc=com"
HTH,
Mark
ACI's are one of the tricker parts of 389-ds that's for sure, but I
hope that helps,
--
Sincerely,
William Brown
Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia
--
Identity Management Development Team
--
_______________________________________________
389-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
