OpenLDAP Quick Tips: Testin...

Previously we covered slaptest and slappasswd, so next is slapacl

Let's take a standard ACL example for protecting access to the userPassword attribute:



We can verify that this does what is expected by using the slapacl tool:



Here we point to our config file, stating that the entry we want to test against is the ghenry user entry and that the user we want to test that has access permissions is the ghenry user. Because we have self write access, we can obviously read that attribute too.

Now if we try to access someone elses password, we get:



I'm not allowed to see the laura users password.

Of course, the rootdn user by passes all ACLs, so as expected, they can read the userPassword attribute:



This should give you a taster of how to test your ACLs on the command line.

Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.