OpenDJ supports two mechanisms to protect access to the directory, access control instructions and privileges.

Access Control Instructions apply to directory data, providing fine-grained control over what a user or group member is authorized to do in terms of LDAP operations. Most access control instructions specify scopes (targets) to which they apply such that an administrative user who has all access to dc=example,dc=com need not have any access to dc=example,dc=org.

Privileges control the administrative tasks that users can perform, such as bypassing the access control mechanism, performing backup and restore operations, making changes to the configuration, and so forth. Privileges are implemented independently from access control. By default, privileges restrict administrative access to directory root users, though any user can be assigned a privilege. Privileges apply to a directory server, and do not have a scope.

Some operations require both privileges and also access control instructions. For example, in order to reset user's passwords, an administrator needs both the password-reset privilege and also access control to write userPassword values on the user entries. By combining an access control instruction with a privilege, you can effectively restrict the scope of that privilege to a particular branch of the Directory Information Tree.

Some Notes#

When a user changes the password of another user, this is considered as a Password Reset, and is protected in OpenDJ with a privilege in addition to the ACI.

More Information#

There might be more information for this subject on one of the following: