forked from extern/egroupware
114 lines
4.1 KiB
Plaintext
114 lines
4.1 KiB
Plaintext
|
#######################################################################
|
||
|
|
#
|
||
|
|
# Access to accounts
|
||
|
|
#
|
||
|
|
#######################################################################
|
||
|
|
|
||
|
|
# only the user itself, the global admin, and the domain admin can
|
||
|
|
# modify user passwords
|
||
|
|
# required for authentication and changing password as user and admin
|
||
|
|
access to dn.regex="^uid=([^,]+),ou=accounts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=userPassword,userPKCS12
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by anonymous auth
|
||
|
|
by self write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow admins to add new accounts to the tree
|
||
|
|
access to dn.regex="^ou=accounts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=children
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$1,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow users readonly access to accounts in their own domain
|
||
|
|
# access is limited to attributes of objectclass inetOrgPerson,mozillaAbPersonAlpha and evolutionPerson
|
||
|
|
# used to display accounts in the addressbook
|
||
|
|
access to dn.regex="ou=accounts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson
|
||
|
|
by dn.children,expand="ou=accounts,ou=$1,dc=localdomain" read
|
||
|
|
by users none break
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow admin account access to accounts in their own domain
|
||
|
|
# used to modify and add new accounts
|
||
|
|
access to dn.regex="ou=accounts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson,@dbmailUser,@shadowAccount
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$1,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
|
||
|
|
#######################################################################
|
||
|
|
#
|
||
|
|
# Access to groups
|
||
|
|
#
|
||
|
|
#######################################################################
|
||
|
|
|
||
|
|
|
||
|
|
# allow admins to add new groups to the tree
|
||
|
|
access to dn.regex="^ou=groups,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=children
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$1,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow admin account access to groups in their own domain
|
||
|
|
# used to modify and add new groups
|
||
|
|
access to dn.regex="^cn=([^,]+),ou=groups,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=entry,@posixGroup,@groupOfNames
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
|
||
|
|
#######################################################################
|
||
|
|
#
|
||
|
|
# Access to personal addressbooks
|
||
|
|
#
|
||
|
|
#######################################################################
|
||
|
|
|
||
|
|
# allow admins to add new personal addressbooks to the tree
|
||
|
|
access to dn.regex="^ou=personal,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=children
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$1,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow admins to add new personal addressbooks
|
||
|
|
# user can read the addressbooks only
|
||
|
|
access to dn.regex="^cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=entry
|
||
|
|
by dn.exact,expand="uid=$1,ou=accounts,ou=$2,dc=localdomain" read
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow user and egwadmin to manage personal addressbook entries
|
||
|
|
access to dn.regex="cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
by dn.exact,expand="uid=$1,ou=accounts,ou=$2,dc=localdomain" write
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
#######################################################################
|
||
|
|
#
|
||
|
|
# Access to group addressbooks
|
||
|
|
#
|
||
|
|
#######################################################################
|
||
|
|
|
||
|
|
# allow admins to add new group addressbooks to the tree
|
||
|
|
access to dn.regex="^ou=shared,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=children
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$1,dc=localdomain" write
|
||
|
|
by users none
|
||
|
|
|
||
|
|
# allow admins to add new group addressbooks
|
||
|
|
# groupmembers can read the addressbooks only
|
||
|
|
access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
attrs=entry
|
||
|
|
by group.expand="cn=$1,ou=groups,ou=$2,dc=localdomain" read
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|
||
|
|
# allow groups and egwadmin to manage group addressbook entries
|
||
|
|
# by group.expand="cn=$1,ou=groups,ou=$2,dc=localdomain" peername=127.0.0.1 write
|
||
|
|
access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,ou=([^,]+),dc=localdomain$"
|
||
|
|
by group.expand="cn=$1,ou=groups,ou=$2,dc=localdomain" write
|
||
|
|
by dn.exact,expand="cn=egwadmin,ou=$2,dc=localdomain" write
|
||
|
|
by * none
|
||
|
|
|