[389-users] Re: Shadow attributes in search

On 13 Nov 2025, at 01:21, Jonathan Buzzard via 389-users <389-users@lists.fedoraproject.org> wrote:

aci: (target="ldap:///ou=people,dc=example,dc=com")(targetattr="shadowExpire")(version3.0; acl "aci for shadowExpire"; allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";)

No space between version and 3.0. 

That's all I can see that's wrong here. 

I think your target selector is wrong too, because that means "only on the exact object named ou=people,dc=... " where you probably want target="ldap:///uid=*,ou=people,dc=example,dc=com".

ACI's are one of the tricker parts of 389-ds that's for sure, but I hope that helps, 

-- 
Sincerely,

William Brown

Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia