From 31ce6fc73565aa800f9612cb2c4223e71c7094c7 Mon Sep 17 00:00:00 2001
From: Jonas Smedegaard <dr@jones.dk>
Date: Wed, 17 Sep 2008 09:14:10 +0200
Subject: Move password access to 08 (from 20).

---
 ldap/db/08_base.conf.in | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 ldap/db/08_base.conf.in

(limited to 'ldap/db/08_base.conf.in')

diff --git a/ldap/db/08_base.conf.in b/ldap/db/08_base.conf.in
new file mode 100644
index 0000000..1d78c6a
--- /dev/null
+++ b/ldap/db/08_base.conf.in
@@ -0,0 +1,10 @@
+# The userPassword by default can be changed
+# by the entry owning it if they are authenticated.
+# Others should not be able to see it, except the
+# admin entry below
+access to dn.subtree="ou=SAM,@SUFFIX@" attrs=userpassword,shadowLastChange
+        by dn.exact="@ADMIN@" write
+	by group="cn=SAM,ou=Administrators,ou=Access Control,@SUFFIX@" write
+        by anonymous auth
+        by self write
+        by * none
-- 
cgit v1.2.3