Is possible to limit the visibility of a standard LDAP user?

I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile.

I tried to apply a deny permission on the OU(organizational unit) but there are some default grant permission on the user object and since they are in a closer level, they can override the deny setting.

by default "authenticated users" can read on an user object:

general,public,personal,web informations

I could:

  • remove user by user these "authenticated users" permissions,

  • add user by user "self" read permissions

  • deny users read on the OU's sub-objects

but is quite painful and I'm not sure if it can cause malfunctions.

someone have some advise? Is there an easier approach?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.