dn: OU=pop-ac,ou=pops,dc=my,dc=domain
changetype: modify
add: aci
aci: (targetattr!="userPassword") (version 3.0;acl "All attributes PoP-AC Permissions";allow (read,search,compare) userdn="ldap:///uid=my-test-user,ou=aplicacoes,dc=my,dc=domain";)
Log:
06/Sep/2017:16:15:32.427750186 -0300] - DEBUG - NSACLPlugin - print_access_control_summary - conn=47 op=1 (main): Deny search on entry(uid=rodrigo.nonato,ou=pop-ac,ou=pops,dc=my,dc=domain).attr(objectClass) to uid=my-test-user,ou=aplicacoes,dc=my,dc=domain: no aci matched the subject by aci(242): aciname= "SIE Group", acidn="dc=my,dc=domain"
=> SIE Group is one of the default 389 ACIs.
or
Whole domain scope:
dn: dc=my,dc=domain
changetype: modify
add: aci
aci: (target="ldap:///OU=pop-ac,ou=pops,dc=my,dc=domain")(targetattr!="userPassword") (version 3.0;acl "All attributes PoP-AC Permissions";allow (read,search,compare) userdn="ldap:///uid=my-test-user,ou=aplicacoes,dc=my,dc=domain";)
Log:
[06/Sep/2017:16:41:33.824679480 -0300] - DEBUG - NSACLPlugin - print_access_control_summary - conn=50 op=1 (main): Deny search on entry(uid=rodrigo.nonato,ou=pop-ac,ou=pops,dc=my,dc=domain).attr(objectClass) to uid=my-test-user,ou=aplicacoes,dc=my,dc=domain: no aci matched the subject by aci(253): aciname= "All attributes PoP-AC Permissions", acidn="dc=my,dc=domain"