# ::maintainer::
# ::copy::
#
# aggiunge acl di accesso per ldap



# SAMBA

# users can authenticate and change their password
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by self write
	by anonymous auth
	by * none

# some attributes need to be readable anonymously so that 'id user' can answer correctly
access to attrs=objectClass,entry,homeDirectory,uid,uidNumber,gidNumber,memberUid
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by * ::ldap.default_perm::

# somme attributes can be writable by users themselves
access to attrs=description,telephoneNumber,roomNumber,homePhone,loginShell,gecos,cn,sn,givenname
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by self write
	by * ::ldap.default_perm::

# some attributes need to be writable for samba
access to attrs=cn,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaLogonTime,sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,sambaLogonScript,sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,sambaDomainName,sambaMungedDial,sambaBadPasswordCount,sambaBadPasswordTime,sambaPasswordHistory,sambaLogonHours,sambaSID,sambaSIDList,sambaTrustFlags,sambaGroupType,sambaNextRid,sambaNextGroupRid,sambaNextUserRid,sambaAlgorithmicRidBase,sambaShareName,sambaOptionName,sambaBoolOption,sambaIntegerOption,sambaStringOption,sambaStringListoption,sambaPrivilegeList
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by self read
	by * ::ldap.default_perm::

# samba need to be able to create the samba domain account
access to dn.base="::ldap.base::"
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by * ::ldap.default_perm::

# samba need to be able to create new users account
access to dn="ou=::ldap.slot_users::,::ldap.base::"
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by * ::ldap.default_perm::

# samba need to be able to create new groups account
access to dn="ou=::ldap.slot_groups::,::ldap.base::"
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by * ::ldap.default_perm::

# samba need to be able to create new computers account
access to dn="ou=::ldap.slot_computers::,::ldap.base::"
        by dn="::ldap.admin::" write
	by dn="::auth.samba.admin_ldap_user::" write
	by dn="::ldap.repl_user::" read
	by * ::ldap.default_perm::

# REPLICATOR

# let the replica DN have limitless searches
limits dn.exact="::ldap.repl_user::"
	time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

access to dn.base="::ldap.base::"
        by dn="::ldap.admin::" write
	by dn="::ldap.repl_user::" read
	by * ::ldap.default_perm::


