[389-users] Re: Shadow attributes in search

On 11/14/25 9:43 PM, William Brown wrote:

On 13 Nov 2025, at 01:21, Jonathan Buzzard via 389-users <389-users@lists.fedoraproject.org> wrote:

aci: (target="ldap:///ou=people,dc=example,dc=com")(targetattr="shadowExpire")(version3.0; acl "aci for shadowExpire"; allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";)

No space between version and 3.0. 

That's all I can see that's wrong here. 

I think your target selector is wrong too, because that means "only on the exact object named ou=people,dc=... " where you probably want target="ldap:///uid=*,ou=people,dc=example,dc=com".

Actually the target is fine, it is supposed to be the parent.  It's the bind rule (userdn=) that narrows the scope.

And William is right, you just need a space between "version" and "3.0":

dn: dc=example,dc=com
changetype: modify
add: aci
aci: (target="ldap:///ou=people,dc=example,dc=com")(targetattr="shadowExpire")(version 3.0; acl "aci for shadowExpire"; allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";)

modifying entry "dc=example,dc=com"

HTH,

Mark

ACI's are one of the tricker parts of 389-ds that's for sure, but I hope that helps, 

-- 
Sincerely,

William Brown

Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia

--   Identity Management Development Team