On 15/11/2025 13:56, Mark Reynolds wrote:
On 11/14/25 9:43 PM, William Brown wrote:
On 13 Nov 2025, at 01:21, Jonathan Buzzard via 389-users <389-
[email protected]> wrote:
aci: (target="ldap:///ou=people,dc=example,dc=com";)
(targetattr="shadowExpire")(version3.0; acl "aci for shadowExpire";
allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";;)
No space between version and 3.0.
That's all I can see that's wrong here.
I think your target selector is wrong too, because that means "only on
the exact object named ou=people,dc=... " where you probably want
target="ldap:///uid=*,ou=people,dc=example,dc=com";.
Actually the target is fine, it is supposed to be the parent. It's the
bind rule (userdn=) that narrows the scope.
And William is right, you just need a space between "version" and "3.0":
dn: dc=example,dc=com
changetype: modify
add: aci
aci: (target="ldap:///ou=people,dc=example,dc=com";)
(targetattr="shadowExpire")(version 3.0; acl "aci for shadowExpire";
allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";;)
modifying entry "dc=example,dc=com"
Thank you very much, the space did the trick. I think I could probably
have looked at that for many more hours without spotting that.
JAB.
--
Jonathan A. Buzzard Tel: +44141-5483420
HPC System Administrator, ARCHIE-WeSt.
University of Strathclyde, John Anderson Building, Glasgow. G4 0NG
--
_______________________________________________
389-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
