Default acis on DS 5.2

Question

Hello everyone.
I have recently set up DS 5.2. I plan to not allow anonymous access. I noticed however that on o=Netscaperoot and below, anonymous access is enabled by default. I would like to ask if it is ok to remove these acis, or this could cause problems.
thank you in advance.

Answer 1

2) Your aci assumes that "targetattr !=" means all
attributes except the following. That's not the way
access control works. By default, the DS denies
access to everything unless access is explicitly
granted. So, unless you have another aci that allows
access to (targetattr = "*"), this won't work.That's what I thought, too, but I tested an ACI that allowed access to all fields, and in fact retrieved everything including those explicitly disallowed by the first ACI. So I looked back at my original attempt and noticed it still had the string "aci:" in front. when I removed that (and the "all permission" ACI) the directory server started behaving as expected. Problem apparently solved, except "why did the ACI syntax checker not barf on that ACI?"
A now-rhetorical question... thanks!