Access Control

Access to slapd entries and attributes is controlled by the olcAccess attribute, whose values are a sequence of access directives. The general form of the olcAccess configuration is:

对于slapd和条目的访问受到存取配置文件指令的控制。一个存取控制行的通常的格式如下：

        olcAccess: 
         ::= to 
                [by   ]+
         ::= * |
                [dn[.]= | dn.=]
                [filter=] [attrs=]
         ::= regex | exact
         ::= base | one | subtree | children
         ::=  [val[.]=] |  , 
         ::=  | entry | children
         ::= * | [anonymous | users | self
                        | dn[.]= | dn.=]
                [dnattr=]
                [group[/[/][.]]=]
                [peername[.]=]
                [sockname[.]=]
                [domain[.]=]
                [sockurl[.]=]
                [set=]
                [aci=]
         ::= [self]{|}
         ::= none | auth | compare | search | read | write
         ::= {=|+|-}{w|r|s|c|x|0}+
         ::= [stop | continue | break]

where the part selects the entries and/or attributes to which the access applies, the part specifies which entities are granted access, and the part specifies the access granted. Multiple triplets are supported, allowing many entities to be granted different access to the same set of entries and attributes. Not all of these access control options are described here; for more details see the slapd.access(5) man page.

其中，部分选择了该存取控制应用的条目或者属性。部分说明了哪一个身份被赋予访问权限，部分说明了赋予什么样的访问权限。可以指定多个 3元组，以允许为相同的条目和属性赋予多个身份不同的访问权限。

详细介绍请查看slapd.access(5) man page.