ACL for LDAP Server ver 5.1

You can't prevent the bind operation (without using the Directory Proxy Server), but you can prevent the client from viewing any data once bound.

Add an ACI similar to this to the root entry of the directory tree:

aci: (targetattr="*")(version 3.0;acl "Restrict Anonymous Access";deny(all) ip="192.168.1.1" or ip="192.168.1.2" and authmethod="none";)

This says "for all attributes, deny all permissions (read, write, search, etc.) for binds that come from the specified IP addresses and are not authenticated (i.e., anonymous)".

Check out the Sun ONE Directory Server 5.2 Administration Guide for more info. The ACI formats should be the same between 5.1 and 5.2.

chadklunck at 2007-7-7 3:48:21 >