1

I want to deny read and search access to all attributes in my small ldap record except to ldap:///self

I tried

(targetattr="foo||bar||bat") (version 3.0; acl "deny-all"; deny (read, search, compare) userdn="ldap:///anyone";)

(targetattr="foo||bar||bat") (version 3.0; acl "allow-some"; allow (read, search, compare) userdn="ldap:///self";)

but this didn't work.

Any tips? Am I missing something?

thanks -Bill

Bill Spornitz
  • 72
  • 5

1 Answers1

1

It turned out to be fairly straightforward:

(targetattr="foo||bar||bat") (version 3.0; acl "deny-all"; deny (read, search, compare) NOT userdn="ldap:///self";)

Bill Spornitz
  • 72
  • 5