Anupam: Please start a wiki page on: http://directory.fedoraproject.org/wiki/Design/.

Any progress?

It's a rough one, but an example usage of acl utility:

aclutil -D -w < binddnpw> -a "aci_name" | -f "aci_file" [ -b basedn ] [ -t [ -n ] ] [ -x ] [ -u userdn ] [ -g groupdn ] ...

-b basedn: if basedn is given, evaluate entries in under the basedn (basedn could be a suffix); otherwise, evaluate all; note: we could separate suffixes in the database from the dse (cn=config, cn=schema, etc.) E.g., to evaluate "cn=config", we have to specify "-s cn=config".

-a "aci_name": use "aci_name" in the server. If suffix is given, search the aci in the suffix. If it does not exist, just report it.

-f "aci_file": read the aci_file and evaluate the entries based upon the aci. The result is depending upon the options followed.

-t: (targetdn) return matched DNs based upon the given aci.
E.g., if a concrete DN is given, "ou=People,dc=example,dc=com", return all the DNs under "ou=People,dc=example,dc=com". If "-n" is added, just the count of the DNs is returned.
If the DN contains wildcards and/or macros, evaluate them and return matched DNs.

-x: (target attribute) return matched attributes based upon the given aci. Probably, if -x is set, we have to enforce to set -t.

-u userdn: show what this user can do. ( -b basedn could narrow down the area to examine. If -x is given, each attributes are examined? )
search: entries the user can search
read: entries the user can read
compare: entries the user can compare
add: entries the user can add
modify: entries the user can modify
delete: entries the user can delete
selfwrite: entries the user can self-write

-g groupdn: show what users belonging to the group can do. ( -b basedn could narrow down the area to examine. If -x is given, each attributes are examined? )
search: entries the user can search
read: entries the user can read
compare: entries the user can compare
add: entries the user can add
modify: entries the user can modify
delete: entries the user can delete
selfwrite: entries the user can self-write

Could you merge it into your idea? Of course, feel free to make any changes...

wiki page created http://directory.fedoraproject.org/wiki/Design/Ticket_47460_ACL_Utility

wiki page created http://directory.fedoraproject.org/wiki/Design/Ticket_47460_ACL_Utility

http://www.port389.org/docs/389ds/design/acl-utility.html

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/797

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.