Modifying the ACI and entry owner values

Edit online

Use this information to modify the ACI and entryOwner values.

Procedure

  1. Create or replace the value for an attribute.
    Modify-replace
    Modify-replace works the same way as all other attributes. If the attribute value does not exist, create the value. If the attribute value exists, replace the value. For example:
    Given an ACI for an entry: Do the following change: The resulting ACI is as follows: 
    aclEntry: group:cn=Dept ABC,o=sample:normal:grant:rsc 
aclPropagate: true 
    dn: cn=some entry 
changetype: modify 
replace: aclEntry 
aclEntry: group:cn=Dept XYZ,o=sample:normal:grant:rsc 
    aclEntry: group:cn=Dept XYZ,o=sample:normal:grant:rsc 
aclPropagate: true
    ACI values for Dept ABC are lost through the replace action.    		 
    ibm-filterAclEntry: group:cn=Dept ABC,o=sample:
(cn=Manager ABC):normal
:grant:rsc 
ibm-filterAclInherit: true 
    dn: cn=some entry 
changetype: modify 
replace: ibm-filterAclEntry 
ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:grant:rsc 

dn: cn=some entry 
changetype: modify 
replace: ibm-filterAclInherit 
ibm-filterAclInherit: false 
    ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:grant:rsc 
ibm-filterAclInherit: false
    ACI values for Dept ABC are lost through the replace action.
  2. Add a value to an ACI or entryOwner.
    Modify-add
    During an idsldapmodify-add, if the ACI or entryOwner does not exist, the ACI or entryOwner with the specific values is created. If the ACI or entryOwner exists, then add the specified values to the ACI or entryOwner. For example:
    Given an ACI for an entry: With a modification: Yields a multi-valued aclEntry of: 
    aclEntry: group:cn=Dept XYZ,o=sample:
normal:grant:rsc 
    dn: cn=some entry 
changetype: modify 
add: aclEntry 
aclEntry: group:cn=Dept ABC,o=sample:
at.attribute1:grant:rsc 
    aclEntry: group:cn=Dept XYZ,o=sample:
normal:grant:rsc 
aclEntry: group:cn=Dept ABC,o=sample:
at.attribute1:grant:rsc 
    Ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:grant:rsc 
    dn: cn=some entry 
changetype: modify 
add: ibm-filterAclEntry 
ibm-filterAclEntry: group:cn=Dept ABC,o=sample:
(cn=Manager ABC)
:at.attribute1:grant:rsc 
    Ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:grant:rsc
ibm-filterAclEntry: group:cn=Dept ABC,o=sample:
(cn=Manager ABC):at.attribute1
:grant:rsc
    The permissions under the same attribute or attribute class are considered as the basic building blocks and the actions are considered as the qualifiers. If the same permission value is being added more than one time, only one value is stored. If the same permission value is being added more than one time with different action values, the last action value is used. If the resulting permission field is empty (""), this permission value is set to null and the action value is set to grant. For example:
    Given an ACI for an entry: With a modification: Yields a multi-valued aclEntry of: 
    aclEntry: group:cn=Dept XYZ,o=sample:normal:grant:rsc 
    dn: cn=some entry 
changetype: modify 
add: aclEntry 
aclEntry: group:cn=Dept XYZ,o=IBM:
normal:deny:r:critical:
deny::sensitive
:grant:r 
    aclEntry: group:cn=Dept 
XYZ,o=sample:normal:grant:sc:
normal:deny:r:critical
:grant::sensitive:grant:r 
    Ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:grant:rsc 
    dn: cn=some entry 
changetype: modify 
add: ibm-filterAclEntry 
ibm-filterAclEntry: 
group:cn=Dept XYZ,o=sample:
(cn=Manager XYZ):normal
:deny:r:critical:deny:
:sensitive:grant:r
    		 
    ibm-filterAclEntry: group:
cn=Dept XYZ,o=sample:(cn=Manager 
XYZ):normal
:grant:sc:normal:deny
:r:critical:grant:
:sensitive:grant:r
  3. Delete a particular ACI value.
    Modify-delete
    To delete a particular ACI value, use the regular idsldapmodify-delete syntax.
    Given an ACI for an entry: Yields the remaining ACI on the server of: 
    aclEntry: group:cn=Dept XYZ,o=sample:object:grant:ad 
aclEntry: group:cn=Dept XYZ,o=sample:normal:grant:rwsc 

dn: cn = some entry 
changetype: modify 
delete: aclEntry 
aclEntry: group:cn=Dept XYZ,o=sample:object:grant:ad 
    aclEntry: group:cn=Dept XYZ,o=sample:normal:grant:rwsc 
    ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:(cn=Manager XYZ):object
:grant:ad 
ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:(cn=Manager XYZ):normal
:grant:rwsc 

dn: cn = some entry 
changetype: modify 
delete: ibm-filterAclEntry 
ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:(cn=Manager XYZ):object
:grant:ad 
    ibm-filterAclEntry: group:cn=Dept XYZ,o=sample:(cn=Manager XYZ):normal
:grant:rwsc

    Deleting an ACI or entryOwner value that does not exist results in an unchanged ACI or entryOwner and a return code specifies that the attribute value does not exist.