diff options
Diffstat (limited to 'ldap/acl.ldif')
| -rw-r--r-- | ldap/acl.ldif | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/ldap/acl.ldif b/ldap/acl.ldif index ac2e19d..c84d328 100644 --- a/ldap/acl.ldif +++ b/ldap/acl.ldif @@ -32,7 +32,7 @@ replace: olcAccess # TODO: if possible, make use GSSAPI for the services. olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" attrs=entry,objectClass,fvd,fripostIsStatusActive,fripostIsStatusPending,fripostOptionalMaildrop,fvu,fva,fripostMaildrop,fvl,fvlc,fripostLocalAlias - filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualMailbox)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand)) + filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand)) by dn.exact="cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=dev" =rsd by users none break # @@ -69,7 +69,7 @@ olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" # The postmaster of a domain can change (replace) his/her users' # password (but not see it). olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) + filter=(objectClass=FripostVirtualUser) attrs=userPassword by group/fripostVirtualDomain/fripostPostmaster.expand="$1" =w # @@ -177,24 +177,24 @@ olcAccess: to dn.regex="^(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$ # # Noone (but the managers) can change quotas. olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) - attrs=fripostMailboxQuota + filter=(objectClass=FripostVirtualUser) + attrs=fripostUserQuota by self read by group/fripostVirtualDomain/fripostPostmaster.expand="$1" read # # 1. Users can modify their own entry. # 2. So can their postmasters. olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) - attrs=@FripostVirtualMailbox + filter=(objectClass=FripostVirtualUser) + attrs=@FripostVirtualUser by self write by group/fripostVirtualDomain/fripostPostmaster.expand="$1" write # -# 1. Postmasters can create mailboxes (but not delete them). +# 1. Postmasters can create users (but not delete them). # (Provided that they have +a access to the parent's "children" attribute.) # 2. Users can read their entry (but not delete it). olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) + filter=(objectClass=FripostVirtualUser) attrs=entry by group/fripostVirtualDomain/fripostPostmaster.expand="$1" +ard by self +rd |