FeministWiki:LDAP Schema: diferenças entre revisões

FeministWiki:LDAP Schema (ver código-fonte)

Revisão das 18h46min de 24 de dezembro de 2019

522 bytes adicionados , 24 de dezembro de 2019

→‎Attribute permissions

Technician

Burocratas, Administradores da interface, Administradores

586

edições

@@ Linha 74: / Linha 74: @@
 === Attribute permissions ===
-We want members to be able to change some of their own settings without requiring privilege escalation.  We also want the read-only user to be able to find users via the combination of their username and recovery mail address (the password reset mechanism uses this) but not actually see recovery mail addresses.  The following LDIF statement may be passed to 'ldapmodify' to make the necessary access control changes:
+We want to make the following changes to the default LDAP permissions:
+* Members should be able to change their own display name (<code>sn</code>) and e-mail address (<code>mail</code>).
+* The read-only user should be able to find users via the combination of their username and recovery mail address (<code>fwRecoveryMail</code>), but not actually see their recovery mail addresses.  (The password reset mechanism uses this.)
+* Members should not be able to see who a member was added by (the <code>manager</code> field).
+The following LDIF statement may be passed to 'ldapmodify' to make the necessary access control changes:
   # Modification to be made via 'ldapmodify'
@@ Linha 82: / Linha 88: @@
   olcAccess: {2}to attrs=sn,mail by self write
   olcAccess: {3}to attrs=fwRecoveryMail by self write by dn.exact="cn=readonly,dc=feministwiki,dc=org" search
+ olcAccess: {4}to attrs=manager by self read
   -
+Note that <code>olcAccess</code> entries are evaluated in order, and the first match takes effect.  This can affect performance.  In the statement above, we start inserting entries from index 2, because indexes 0 and 1 already have some meaningful default entries.
 === Password hashing ===