<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Times New Roman, Times, serif">Hello,<br>
<br>
</font>
<blockquote><font face="Times New Roman, Times, serif">The aci
"Admin read-only attributes" grants, for the complete suffix,
read access to 'admin' users for the following attributes.<br>
</font>
<blockquote><tt>"ipaUniqueId || memberOf || enrolledBy ||
krbExtraData || krbPrincipalName || krbCanonicalName ||
krbPasswordExpiration || krbLastPwdChange ||
krbLastSuccessfulAuth || krbLastFailedAuth"</tt><br>
</blockquote>
<font face="Times New Roman, Times, serif"><br>
"userPassword" and "krbPrincipalKey" are not "read-only"
attributes so I guess it is the reason why they are not part of
this list.<br>
<br>
For User life cycle, I would need admin users to be granted
read access on "userPassword" and "krbPrincipalKey".<br>
The scope could be limited to Stage container but I was
wondering if there is a security reason to not grant read access
on the full suffix ?<br>
<br>
thanks<br>
thierry</font><br>
<br>
</blockquote>
</body>
</html>