" } " +
" } " +
"}" );
// check and see if we can access the subentry now
assertNotNull( checkCanSearchSubentryAs( "billyd", "billyd", new Dn(
"ou=phoneBook,uid=billyd,ou=users,ou=system" ) ) );
// now add a denial to prevent all users except the admin from accessing the subentry
addPrescriptiveACI( "anybodySearchTheirSubordinates",
"{ " +
" identificationTag \"anybodyDontSearchTheirSubordinates\", " +
" precedence 14, " +
" authenticationLevel none, " +
" itemOrUserFirst userFirst: " +
" { " +
" userClasses { parentOfEntry }, " +
" userPermissions " +
" { " +
" { " +
" protectedItems {entry, allUserAttributeTypesAndValues}, " +
" grantsAndDenials { denyRead, denyReturnDN, denyBrowse } " +
" } " +
" } " +
" } " +
"}" );
// now we should not be able to access the subentry with a search
assertNull( checkCanSearchSubentryAs( "billyd", "billyd", new Dn( "ou=phoneBook,uid=billyd,ou=users,ou=system" ) ) );
}