# slapacl

## NAME



           slapacl - Check access to a list of attributes.
    


## SYNOPSIS



           **SBINDIR/slapacl -b** _DN_ [**-d** _debug-level_] [**-D** _authcDN_ | **-U** _authcID_]
           [**-f** _slapd.conf_] [**-F** _confdir_] [**-o** _option_[**=**_value_]] [**-u**] [**-v**]
           [**-X** _authzID_ | **-o  authzDN=**_DN_] [_attr_[**/**_access_][**:**_value_]] [...]
    


## DESCRIPTION



           **slapacl** is used to check the behavior of slapd(8) by verifying
           access to directory data according to the access control list
           directives defined in its configuration.  It opens the
           slapd.conf(5) configuration file or the slapd-config(5) backend,
           reads in the **access** /**olcAccess** directives, and then parses the **attr**
           list given on the command-line; if none is given, access to the
           **entry** pseudo-attribute is tested.
    


## OPTIONS



           **-b** _DN_  specify the _DN_ which access is requested to; the
                  corresponding entry is fetched from the database, and thus
                  it must exist.  The _DN_ is also used to determine what rules
                  apply; thus, it must be in the naming context of a
                  configured database. By default, the first database that
                  supports the requested operation is used.  See also **-u**.
    
           **-d** _debug-level_
                  enable debugging messages as defined by the specified
                  _debug-level_ ; see slapd(8) for details.
    
           **-D** _authcDN_
                  specify a DN to be used as identity through the test
                  session when selecting appropriate **< by> **clauses in access
                  lists.
    
           **-f** _slapd.conf_
                  specify an alternative slapd.conf(5) file.
    
           **-F** _confdir_
                  specify a config directory.  If both **-f** and **-F** are
                  specified, the config file will be read and converted to
                  config directory format and written to the specified
                  directory.  If neither option is specified, an attempt to
                  read the default config directory will be made before
                  trying to use the default config file. If a valid config
                  directory exists then the default config file is ignored.
    
           **-o** _option_[**=**_value_]
                  Specify an _option_ with a(n optional) _value_.  Possible
                  generic options/values are:
    
                         syslog=<subsystems>  (see `-s' in slapd(8))
                         syslog-level=<level> (see `-S' in slapd(8))
                         syslog-user=<user>   (see `-l' in slapd(8))
    
                  Possible options/values specific to **slapacl** are:
    
                         authzDN
                         domain
                         peername
                         sasl_ssf
                         sockname
                         sockurl
                         ssf
                         tls_ssf
                         transport_ssf
    
                  See the related fields in slapd.access(5) for details.
    
           **-u** enable dry-run mode. Do not fetch any entries from the
                  database.  In this case, a fake entry with the _DN_ given
                  with the **-b** option is used, with no attributes.  As a
                  consequence, those rules that depend on the contents of the
                  target object or any other database objects will not behave
                  as with the real object.  The _DN_ given with the **-b** option
                  is still used to select what rules apply; thus, it must be
                  in the naming context of a configured database.  See also
                  **-b**.
    
           **-U** _authcID_
                  specify an ID to be mapped to a **DN** as by means of
                  **authz-regexp** or **authz-rewrite** rules (see slapd.conf(5) for
                  details); mutually exclusive with **-D**.
    
           **-v** enable verbose mode.
    
           **-X** _authzID_
                  specify an authorization ID to be mapped to a **DN** as by
                  means of **authz-regexp** or **authz-rewrite** rules (see
                  slapd.conf(5) for details); mutually exclusive with **-o**
                  **authzDN=**_DN_.
    


## EXAMPLES



           The command
    
                SBINDIR/slapacl -f ETCDIR/slapd.conf -v \
                       -U bjorn -b "o=University of Michigan,c=US" \
                    "o/read:University of Michigan"
    
           tests whether the user _bjorn_ can access the attribute _o_ of the
           entry _o=University of Michigan,c=US_ at _read_ level.
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *