{scrollbar}
+ApacheDS uses an adaptation of the X.500 basic access control scheme in +combination with X.500 subentries to control access to entries and +attributes within the DIT. This document will show you how to enable the +basic access control mechanism and how to define access control information +to manage access to protected resources.
+The ACIItem syntax is very expressive and that makes it extremely powerful +for specifying complex access control policies. However the syntax is not +very easy to grasp for beginners. For this reason we start with simple +examples that focus on different protection mechanisms offered by the +ACIItem syntax. We do this instead of specifying the grammar which is not +the best way to learn a language.
+{warning:title=Before you go any further...} +Please don't go any further until you have read up on the use of +Subentries. Knowledge of subentries, subtreeSpecifications, administrative +areas, and administrative roles are required to properly digest the +following material. +{warning}
+Before going on to these trails you might want to set up an Administrative +Area for managing access control via prescriptiveACI. Both subentryACI and +prescriptiveACI require the presence of an Administrative Point entry. For +more information and code examples see ACAreas +.
+Here are some trails that resemble simple HOWTO guides. They're ordered +with the most pragmatic usage first. We will add to these trails over +time.
+| Trail | Description |
|---|---|
| [EnableSearchForAllUsers](enablesearchforallusers.html) + | Enabling access to browse and read all entries and their attributes by +authenticated users. |
| DenySubentryAccess (TBW) | Protecting access to subentries themselves. |
| [AllowSelfPasswordModify](allowselfpasswordmodify.html) + | Granting users the rights needed to change their own passwords. |
| GrantAddDelModToGroup (TBW) | Granting add, delete, and modify permissions +to a group of users. |
| GrantModToEntry (TBW) | Applying ACI to a single entry. |
