Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1371559

Summary:	ACI syntax, if targetattr (and targetattrfilter) is missing then NO attribute are targeted
Product:	Red Hat Directory Server	Reporter:	thierry bordaz <tbordaz>
Component:	Doc-administration-guide	Assignee:	Marc Muehlfeld <mmuehlfe>
Status:	CLOSED DUPLICATE	QA Contact:	Viktor Ashirov <vashirov>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	10.0	CC:	mmuehlfe, rhel-docs
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-18 14:27:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description thierry bordaz 2016-08-30 13:17:02 UTC

Description of problem:

The following aci:
(targetfilter = "(&(memberOf=cn=devel-group,cn=groups,SUFFIX))")
(version 3.0;acl "group_manager allowed to update any member of devel group";                                                                          
allow (all) groupdn = "ldap:///cn=group_manager,cn=groups,SUFFIX";)

allows 'group_manager' to ADD/DEL/MODDN/SRCH all members of 'devel-group', but does not allow to access any attribute of those members.
targetattr being missing, it means that NO attribute are targeted by this aci.



I think we need to update https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/Managing_Access_Control-Creating_ACIs_Manually.html#Defining_Targets-Targeting_Attributes to inform that if 'targetattr' is missing, no attribute can be read/updated from the targeted entries.

Comment 1 Marc Muehlfeld 2016-11-18 14:27:21 UTC

I updated this a few days ago while working on a different BZ. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1261944#c1

*** This bug has been marked as a duplicate of bug 1261944 ***