#
# Schema 1 and Schema 2 compatibility mode Ldap entries for the root
#  of the Domain Component (DC) tree.
#
# This ldif file is invoked during the second phase of the installer
# i.e. by the devsetup program for developer install, or by the configure
#      program for the full habanero installer
#
# TODO: split this file into cfgldap and ugldap entries, because those
#   maybe separate directories
#
# For every ldap entry I want to create in the directory (i.e. the
#  DN and its attribute/values). I need several ldif entries:
#  1. one ldif entry for adding the DN in case it does not exist
#  2. one ldif entry for each attribute/value pair regardless of whether
#     it is a "add" or "replace" operation. 
#  3. one ldif entry to do a "delete" if you want the existing attribute
#     to be deleted first, and there are multiple values to add for that
#     attribute. I.e. to "replace" the existing attribute with
#     new values.
#  Instead of a "delete" and "add", you could do "replace" if there is
#  only a single value for the attribute.
#
#  Aside:
#     I realize that I can combine the replace operation for an attribute
#     into a single ldif entry since, replace will not fail if the attribute
#     does not exist. But it is just more flexible to handle each 
#     attribute/value pair individually in case, there are different
#     behaviors for upgrade/uninstall, or if you want to change it to add
#     later. 
#      
# NOTE
# - so be very careful when editing an ldif entry. Be aware that there 
#   may be an attribute of the same name at the same DN. 
#
# This file originally tried to delete all the DNs, but that is a fruitless
# exercise since there is no way to delete a DN and all its leaves.
#
# attributes that have multiple values (i.e. use multiple add ldif entries,
#  instead of a single replace ldif entry)
# - aci
# - nsSSL3Ciphers
#
#--------------------------------------------------
# dc tree
#--------------------------------------------------

########################################
# dn: <msg.dctree.Suffix.1>
# Originally from iMS 5.2: msg.ugldap.dctree.inf
########################################

# dc tree suffix should have been created by dssetup
dn: <msg.dctree.Suffix.1>
changetype: modify
replace: description
description: top level node in the Domain Component (DC) tree

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (version 3.0; acl "SA root node access - product=ims5.0,class=nda,num=3,version =1"; allow (all) groupdn="ldap:///cn=Service Administrators,ou=Groups,<local.ugldapbasedn>";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (version 3.0; acl "Domain Admin dc root access - product=ims5.0,class=nda,num=4 ,version=1"; allow (read,search) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Domain Administrators*)" or userdn="ldap:///<local.ugldapbasedn>??sub?(memberOf=cn=Domain Administrators*)";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetfilter="objectclass=nsManagedDomain")
 (version 3.0; acl "Domain Admin domain container access - product=ims5.0,class=nda,num=5,version=1"; deny (delete,write) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Domain Administrators*)" or userdn="ldap:///<local.ugldapbasedn>??sub?(memberOf=cn=Domain Administrators*)";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=inetOrgPerson))
 (version 3.0; acl "User self search and read - product=ims5.0,class=nda,num=6,version=1"; allow (read,search) userdn="ldap:///self";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr = "*")
 (version 3.0; acl "Allow self entry modification - product=ims5.0,class=nda,num=7,version=1"; allow (write) userdn = "ldap:///self";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="uid||ou||owner||nsDAModifiableBy||nsDACapability||mail||mailAlternateAddress||memberOf||nsDADomain||inetuserstatus||mailuserstatus||memberOfManagedGroup||mailQuota||mailMsgQuota||inetSubscriberAccountId||dataSource||mailhost||mailAllowedServiceAccess||pabURI||inetCOS")
 (targetfilter=(objectClass=nsManagedPerson))
 (version 3.0; acl "User self modification - product=ims5.0,class=nda,num=8,version=1"; deny (write) userdn = "ldap:///self" and userdn != "ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Domain Administrators*)" and userdn != "ldap:///<local.ugldapbasedn>??sub?(memberOf=cn=Domain Administrators*)" and groupdn != "ldap:///cn=Service Administrators,ou=groups,<local.ugldapbasedn>";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetfilter=(objectClass=inetOrgPerson))
 (version 3.0; acl "User self deletion - product=ims5.0,class=nda,num=9,version=1"; deny (delete) userdn="ldap:///self";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=inetMailGroupManagement))
 (version 3.0; acl "Mail list create access - product=ims5.0,class=nda,num=10,version=1"; allow (add) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(nsDACapability=mailListCreate)";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=inetMailGroupManagement))
 (version 3.0; acl "Mail list owner access - product=ims5.0,class=nda,num=11,version=1"; allow (read,search,write,delete) groupdnattr="ldap:///<msg.dctree.Suffix.1>?owner";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=inetManagedGroup))
 (version 3.0; acl "Family Group Adm group read & search access - product=ims5.0 ,class=nda,num=12,version=1"; allow (read,search) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="description")
 (targetfilter=(objectClass=inetManagedGroup))
 (version 3.0; acl "Family Group Adm description write access - product=ims5.0,class=nda,num=13,version=1"; allow (write) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="mnggrpCurrentUsers")
 (targetfilter=(objectClass=inetManagedGroup))
 (version 3.0; acl "Family Group Adm description write access - product=ims5.0,class=nda,num=14,version=1"; allow (write) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=nsManagedPerson))
 (version 3.0;acl "Family Group Adm member access - product=ims5.0,class=nda,num=15,version=1"; allow (add,read,search,write,delete) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="uniquemember")
 (targetfilter=(&(|(objectClass=nsManagedDept)(objectClass=nsManagedDeptAdminGroup))(cn=Family Group Administrators*)))
 (version 3.0;acl "Family Group Adm admin write access - product=ims5.0,class=nda,num=16,version=1"; allow (write) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?uniquemember";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="memberOf")
 (targetfilter=(objectClass=nsManagedPerson))
 (version 3.0;acl "Family Adm user access - product=ims5.0,class=nda,num=17,version=1"; allow (write) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)" and groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="objectclass||preferredmailhost||preferredmailmessagestore")
 (targetfilter=(objectClass=domain))
 (version 3.0;acl "Family Adm domain access - product=ims5.0,class=nda,num=18,version=1"; allow (read,search) userdn="ldap:///<local.ugldapbasedn>??sub?(memberOf=cn=Family Group Administrators*)" or userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Family Group Administrators*)";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (target="ldap:///<msg.dctree.Suffix.1>")
 (targetattr="*")
 (version 3.0; acl "Messaging Server End User Administrator Read Access Rights - product=ims5.0,class=installer,num=100,version=1"; allow (read,search) groupdn="ldap:///cn=Messaging End User Administrators Group, ou=Groups, <local.ugldapbasedn>";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (target="ldap:///<msg.dctree.Suffix.1>")
 (targetattr="objectclass||mailalternateaddress||mailautoreplymode||mailprogramdeliveryinfo||nswmextendeduserprefs||preferredlanguage||maildeliveryoption||mailforwardingaddress||mailAutoReplyTimeout||mailautoreplytextinternal||mailautoreplytext||vacationEndDate||vacationStartDate||mailautoreplysubject||pabURI||maxPabEntries||mailMessageStore")
 (version 3.0; acl "Messaging Server End User Administrator Write Access Rights - product=ims5.0,class=installer,num=101,version=1"; allow (all) groupdn="ldap:///cn=Messaging End User Administrators Group, ou=Groups, <local.ugldapbasedn>";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="objectclass||preferredmailhost||preferredmailmessagestore||dc")
 (targetfilter=(objectClass=domain))
 (version 3.0;acl "Domain Organization Admin domain access - product=ims5.0,class=nda,num=20,version=1"; allow (read,search) userdn="ldap:///<msg.dctree.Suffix.1>??sub?(memberOf=cn=Domain Organization Administrators*)" or userdn="ldap:///<local.ugldapbasedn>??sub?(memberOf=cn=Domain Organization Administrators*)";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="*")
 (targetfilter=(objectClass=inetdomainorg))
 (version 3.0; acl "Domain Organization Administrator - Dom Org node read & search access - product=ims5.0,class=nda,num=21,version=1"; allow (read,search) groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

#     attribute of objectclass aci
dn: <msg.dctree.Suffix.1>
changetype: modify
add: aci
aci: (targetattr="description||domOrgMaxUsers")
 (targetfilter=(objectClass=inetdomainorg))
 (version 3.0; acl "Domain Organization Administrator - Dom Org node write access - product=ims5.0,class=nda,num=22,version=1"; allow (write) groupdnattr="ldap:///<msg.dctree.Suffix.1>?nsDAModifiableBy";)

