SLAPACL(8C)

💅 SLAPACL 💅

okay so bestie, this is the slapacl page from section 8C of the manual, and honestly? it's giving access-control detective energy. let's get into it 🕵️♀️✨

---

✨ NAME ✨

slapacl — check access to a list of attributes. that's it, that's the whole job, and she does it flawlessly 💖

---

🌸 SYNOPSIS 🌸

/usr/bin/slapacl -b DN [-d debug-level] [-D authcDN | -U authcID]
[-f slapd.conf] [-F confdir] [-o option[=value]] [-u] [-v] [-X authzID |
-o  authzDN=DN] [attr[/access][:value]] [...]

---

🦋 DESCRIPTION 🦋

so like, slapacl is the little sister of slapd(8) whose whole personality is verifying stuff. she checks the behavior of slapd(8) by verifying access to directory data according to the access control list directives defined in its configuration. no cap 🔥

here's the pipeline, step by step:

1. she opens the slapd.conf(5) configuration file or the slapd-config(5) backend
2. she reads in the access/olcAccess directives
3. then she parses the attr list you gave her on the command-line

and if you give her no attr list at all? she just tests access to the entry pseudo-attribute. iconic default behavior tbh 💅

---

✨ OPTIONS ✨

• -b DN — specify the DN which access is requested to; the corresponding entry is fetched from the database, and thus it must exist. the DN is also used to determine what rules apply; thus, it must be in the naming context of a configured database. by default, the first database that supports the requested operation is used. See also -u. 🫶
• -d debug-level — enable debugging messages as defined by the specified debug-level; see slapd(8) for details. (aka: turn on the yapping, but make it useful ✨)
• -D authcDN — specify a DN to be used as identity through the test session when selecting appropriate <by> clauses in access lists. it's giving "who am i pretending to be today" energy 💅
• -f slapd.conf — specify an alternative slapd.conf(5) file.
• -F confdir — specify a config directory. now listen carefully bestie because this one has lore 📖: if both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. if neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. if a valid config directory exists then the default config file is ignored. (she checks the cool new place first, periodt 💖)
• -o option[=value] — Specify an option with a(n optional) value. the possible generic options/values are:

syslog=<subsystems>  (see `-s' in slapd(8))
syslog-level=<level> (see `-S' in slapd(8))
syslog-user=<user>   (see `-l' in slapd(8))

and the possible options/values specific to slapacl are:

authzDN
domain
peername
sasl_ssf
sockname
sockurl
ssf
tls_ssf
transport_ssf

See the related fields in slapd.access(5) for details. 👑

• -u — enable dry-run mode. Do not fetch any entries from the database. in this case, a fake entry with the DN given with the -b option is used, with no attributes. as a consequence, those rules that depend on the contents of the target object or any other database objects will not behave as with the real object. the DN given with the -b option is still used to select what rules apply; thus, it must be in the naming context of a configured database. See also -b. 😭 (manifesting the real entry and getting a cardboard cutout instead)
• -U authcID — specify an ID to be mapped to a DN as by means of authz-regexp or authz-rewrite rules (see slapd.conf(5) for details); mutually exclusive with -D. pick a lane bestie, you can't do both 💀
• -v — enable verbose mode. she will simply tell you everything 🌈
• -X authzID — specify an authorization ID to be mapped to a DN as by means of authz-regexp or authz-rewrite rules (see slapd.conf(5) for details); mutually exclusive with -o authzDN=DN. again: one or the other, not both 🙈

---

🎀 EXAMPLES 🎀

okay so here's the moment you've all been waiting for. this command:

/usr/bin/slapacl -f /etc/openldap/slapd.conf -v \
       -U bjorn -b "o=University of Michigan,c=US" \
    "o/read:University of Michigan"

tests whether the user bjorn can access the attribute o of the entry o=University of Michigan,c=US at read level. slay. that's the whole vibe check in one line 💖✨

---

💜 SEE ALSO 💜

ldap(3), slapd(8), slaptest(8), slapauth(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

---

🌟 ACKNOWLEDGEMENTS 🌟

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. 🫶 giving credit where credit is due, always.

---

and that's the whole page bestie!! this was OpenLDAP 2.7.2, dated 2026/10/21, and no I will not stop talking about slapacl 💅 — she ate, she left no crumbs 👑🎀✨