您好，我一直在嘗試實現管理員和操作員層級的 ACL，但沒有成功。到目前為止我已經
access to attrs=userPassword,shadowLastChange
by self write
by anonymous auth
by set="[cn=Administrators,ou=group,dc=company,dc=com]/member* & user" manage
by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read
by * none
access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,displayName,description,givenName
by anonymous auth
by self =rwdx
by set="[cn=Administrators,ou=group,dc=company,dc=com]/member* & user" manage
by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read
access to dn.subtree="dc=company,dc=com"
by self =rwdx
by set="[cn=Administrators,ou=groups,dc=company,dc=com]/member* & user" manage
by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read
by * break
我需要授予管理員和網域管理員完整的權限和操作員讀取存取權限，透過上述設置，即使管理員也可以獲得讀取存取權限。
有任何想法嗎？謝謝
答案1
我已將配置更改為以下內容，現在似乎可以正常工作
access to attrs=userPassword,sambaNTPassword,shadowLastChange
by anonymous auth
by self write
by group.exact="cn=Administrators,ou=groups,dc=company,dc=com" manage
by group.exact="cn=Operators,ou=groups,dc=company,dc=com" read
access to *
by self write
by dn.exact="uid=austek,ou=Technical,ou=people,dc=company,dc=com" manage
by group.exact="cn=Administrators,ou=groups,dc=company,dc=com" manage
by group.exact="cn=Operators,ou=groups,dc=company,dc=com" read
by * break