Hi guys,<br><br>I am trying to create an organizational unit and an user with ACI, but it looks like my ACI is not defined correctly.<br>Below is my ldif.<br><br>dn: ou=serviceaccounts,dc=test,dc=example,dc=com<br>changetype: add
<br>objectclass: top<br>objectclass: organizationalunit<br>aci:<br> (targetattr = "*")<br> (version 3.0;<br> acl "default aci for service accounts";<br> allow (all)<br> (userdn="ldap:///anyone")
<br> ;)<br><br>dn: cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com<br>changetype: add<br>objectclass: top<br>objectclass: person<br>sn: tscei.obs<br>userPassword: testing123<br>description: This is a test<br>aci:<br>
(targetattr = "*")<br> (version 3.0;<br> acl "user1";<br> deny (all)<br> (userdn="ldap:///self")<br> ;)<br><br>I create an organizational unit that allows all users to modify it, then I create user1 that denies everything.
<br>I then use the below LDIF to perform a LDAP add operation.<br><br>dn: cn=testing123,cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com<br>changetype: add<br>objectclass: top<br>objectclass: room<br><br>I use this ldapmodify command to perform the add operation
<br>ldapmodify -h hostname -p 1389 -D "cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com" -w testing123 -f my_test.ldif -x<br><br>The add operation succeeded unexpectedly. The result that I'm looking for should be not enough privilege to perform add operation.
<br><br>Anyone knows what's wrong with my ACI setup?<br><br>Thanks!<br><br>David<br>