You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "Rashid Mahmood (Jira)" <ji...@apache.org> on 2020/04/22 05:46:00 UTC
[jira] [Created] (DIRSERVER-2306) Removing pwdAccountLockedTime
Attribute with Technical User
Rashid Mahmood created DIRSERVER-2306:
-----------------------------------------
Summary: Removing pwdAccountLockedTime Attribute with Technical User
Key: DIRSERVER-2306
URL: https://issues.apache.org/jira/browse/DIRSERVER-2306
Project: Directory ApacheDS
Issue Type: Task
Affects Versions: 2.0.0-M24
Reporter: Rashid Mahmood
We are connecting to ApacheDS ldap with a technical user created with ACL mentioned below. We are able to cover all of requirements except the possibility for user to unlock his account, when he tried to unlock the account, behind the scene techincal user is unable to remove pwdAccountLockedTime attribute and we receive Access Rights error.
We tried to switch Admin user but then it is contradicting with another requirement of pwdHistory and user was able to reuse existing password during password change https://issues.apache.org/jira/browse/DIRSERVER-2084
Is it possible to handle both requirements with one technical user? our preference was to handle it with our own user instead of default admin
{code:java}
dn: cn=fdLdapAuthorizationRequirementsACISubentry,dc=abc,dc=xyz
changetype: add
objectclass: top
objectclass: subentry
objectclass: accessControlSubentry
cn: fdLdapAuthorizationRequirementsACISubentry
subtreeSpecification: {}
prescriptiveACI: {
identificationTag "directoryManagerFullAccessACI",
precedence 11,
authenticationLevel simple,
itemOrUserFirst userFirst:
{
userClasses
{
name { "uid=fdactmgr,ou=users,ou=system" }
},
userPermissions
{
{
protectedItems
{
entry, allUserAttributeTypesAndValues
},
grantsAndDenials
{
grantAdd, grantDiscloseOnError, grantRead,
grantRemove, grantBrowse, grantExport, grantImport,
grantModify, grantRename, grantReturnDN,
grantCompare, grantFilterMatch, grantInvoke
}
}
}
}
}
{code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org