Global Access Control Policy

Provides coarse grained access control for all operations, regardless of whether they are destined for local or proxy backends. Global access control policies are applied in addition to ACIs and privileges.

For a read request (search, compare) to be accepted there must exist a policy granting the read permission to the targeted entry, as well as any attributes included in attribute assertions. Search result entries will also be filtered using the same criteria. Similarly, update requests (add, delete, modify, modify DN) are accepted if there exists a policy granting the write permission to the targeted entry(s), as well as any attributes included with the request. Finally, extended operations and controls are accepted as long as there exists an applicable policy allowing the extended operation or control, irrespective of the targeted entry. By default a policy will match all entries, all types of connection, and all users. The scope may be restricted by specifying any of the request-target-dn-*, user-dn-*, and connection-* properties.