openldap move access control to hostettings

1 files changed, 25 insertions, 1 deletions

diff --git a/roles/openldap/README.md b/roles/openldap/README.md
index ed34f52..fb30537 100644
--- a/roles/openldap/README.md
+++ b/roles/openldap/README.md
@@ -25,7 +25,31 @@ ldap:
         DESC 'MANDATORY: OpenSSH LPK objectclass'
         MAY ( sshPublicKey $ uid )
         )"
-
+  ous:
+    - users
+    - apps
+    - groups
+    - unixgroups
+  groupsofnames:
+    in: 'ou=groups,dc=example,dc=com'
+    names:
+      - ldap_admin
+      - external_auth
+  access_control:
+    - >-
+      {0}to attrs=userPassword
+      by self write
+      by group/groupOfNames/member=cn=external_auth,ou=groups,dc=example,dc=com read
+      by anonymous auth
+      by * none
+    - >-
+      {1}to attrs=shadowLastChange
+      by self write
+      by * read
+    - >-
+      {2}to *
+      by users read
+      by group/groupOfNames/member=cn=ldap_admin,ou=groups,dc=example,dc=com manage
 ```
 
 ## Notes