[389-users] Re: Shadow attributes in search

On 15/11/2025 13:56, Mark Reynolds wrote:
> On 11/14/25 9:43 PM, William Brown wrote:
>>
>>
>>> On 13 Nov 2025, at 01:21, Jonathan Buzzard via 389-users <389-
>>> users@lists.fedoraproject.org> wrote:
>>>
>>> aci: (target="ldap:///ou=people,dc=example,dc=com")
>>> (targetattr="shadowExpire")(version3.0; acl "aci for shadowExpire";
>>> allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";)
>>
>> No space between version and 3.0.
>>
>> That's all I can see that's wrong here.
>>
>> I think your target selector is wrong too, because that means "only on
>> the exact object named ou=people,dc=... " where you probably want
>> target="ldap:///uid=*,ou=people,dc=example,dc=com".
>
> Actually the target is fine, it is supposed to be the parent.  It's the
> bind rule (userdn=) that narrows the scope.
>
> And William is right, you just need a space between "version" and "3.0":
>
> dn: dc=example,dc=com
> changetype: modify
> add: aci
> aci: (target="ldap:///ou=people,dc=example,dc=com")
> (targetattr="shadowExpire")(version 3.0; acl "aci for shadowExpire";
> allow(read) userdn="ldap:///uid=readonly,ou=people,dc=example,dc=com";)
>
> modifying entry "dc=example,dc=com"
>

Thank you very much, the space did the trick. I think I could probably
have looked at that for many more hours without spotting that.


JAB.

--
Jonathan A. Buzzard Tel: +44141-5483420
HPC System Administrator, ARCHIE-WeSt.
University of Strathclyde, John Anderson Building, Glasgow. G4 0NG
--
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue