From 6239e3f8a77a32333350d7c744db289ec9e4f6e0 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 17 Jan 2013 20:38:37 +0100 Subject: =?UTF-8?q?Mailbox=20=E2=86=92=20User.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ldap/acl.ldif | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'ldap/acl.ldif') diff --git a/ldap/acl.ldif b/ldap/acl.ldif index ac2e19d..c84d328 100644 --- a/ldap/acl.ldif +++ b/ldap/acl.ldif @@ -32,7 +32,7 @@ replace: olcAccess # TODO: if possible, make use GSSAPI for the services. olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" attrs=entry,objectClass,fvd,fripostIsStatusActive,fripostIsStatusPending,fripostOptionalMaildrop,fvu,fva,fripostMaildrop,fvl,fvlc,fripostLocalAlias - filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualMailbox)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand)) + filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand)) by dn.exact="cn=SMTP,ou=services,o=mailHosting,dc=fripost,dc=dev" =rsd by users none break # @@ -69,7 +69,7 @@ olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" # The postmaster of a domain can change (replace) his/her users' # password (but not see it). olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) + filter=(objectClass=FripostVirtualUser) attrs=userPassword by group/fripostVirtualDomain/fripostPostmaster.expand="$1" =w # @@ -177,24 +177,24 @@ olcAccess: to dn.regex="^(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$ # # Noone (but the managers) can change quotas. olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) - attrs=fripostMailboxQuota + filter=(objectClass=FripostVirtualUser) + attrs=fripostUserQuota by self read by group/fripostVirtualDomain/fripostPostmaster.expand="$1" read # # 1. Users can modify their own entry. # 2. So can their postmasters. olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) - attrs=@FripostVirtualMailbox + filter=(objectClass=FripostVirtualUser) + attrs=@FripostVirtualUser by self write by group/fripostVirtualDomain/fripostPostmaster.expand="$1" write # -# 1. Postmasters can create mailboxes (but not delete them). +# 1. Postmasters can create users (but not delete them). # (Provided that they have +a access to the parent's "children" attribute.) # 2. Users can read their entry (but not delete it). olcAccess: to dn.regex="^fvu=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" - filter=(objectClass=FripostVirtualMailbox) + filter=(objectClass=FripostVirtualUser) attrs=entry by group/fripostVirtualDomain/fripostPostmaster.expand="$1" +ard by self +rd -- cgit v1.2.3