HP UX Red Hat Direry Server Software manual Using Get Effective Rights from the Command-Line

Chapter 6. Managing Access Control

In this example, Ted Morris has the right to add, view, delete, or rename the DN on his own entry, as shown by the return values in entryLevelRights. For attributes, he has the right to read, search, compare, self-modify, or self-delete the location (l) attribute but only self-write and self-delete rights to his password, as shown in the attributeLevelRights return value.

Information is not given for attributes in an entry that do not have a value; for example, if the userPassword value is removed, then a future effective rights search on the entry above would not return any effective rights for userPassword, even though self-write and self-delete rights could be allowed. Likewise, if the street attribute were added with read, compare, and search rights, then street: rsc would appear in the attributeLevelRights results.

Table 6.6, “Permissions That Can Be Set on Entries” and Table 6.7, “Permissions That Can Be Set on Attributes” summarize the permissions that can be set on entries and on attributes that are retrieved by the get effective rights operation.

Permission	Description
a	Add.
d	Delete.
n	Rename the DN.
v	View the entry.
Table 6.6. Permissions That Can Be Set on Entries

Permission	Description
r	Read.
s	Search.
w	Write (mod-add).
o	Obliterate(mod-del). Analogous to delete.
c	Compare.
W	Self-write.
O	Self-delete.

Table 6.7. Permissions That Can Be Set on Attributes

7.1. Using Get Effective Rights from the Command-Line

To retrieve the effective rights with ldapsearch, you must pass the control information with the ldapsearch utility's-Joption, as follows:

ldapsearch -pport -hhost -DbindDN -wbindPassword -bsearch_base -Jcontrol OID:boolean criticality:dn:AuthId

212