<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
	<dict>
		<!-- DO NOT MODIFY THIS FILE ---- APPLE USE ONLY
		 permissions are modeled after system ACL design, relevant notes:
		 explicit entries are processed before generic entries
		 stops at first presence of an ACL
		 explicit allow only, no concept of Deny
		 if an explicit ACL is defined, controls apply based on authenticated users, anonymous access is not implicit based
		 (i.e., just cause user requested as UUID X, doesn't mean they have automatic privilege, they must authenticate
		 to Open Directory)
		 owner (UUID ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A) is used for owner (based on credentials or EUID)
		 _unknown (UUID FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063) is used to note anonymous access (i.e., allowing unauthenticated)
		 to do something regardless if authenticated
		 everyone (UUID ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C) is used as expected, to denote any authenticated user to do the
		 operation
		 -->
		<key>dsRecTypeStandard:Users</key>
		<dict>
			<key>dsAttrTypeNative:ShadowHashData</key>
			<array>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeNative:SecureTokenVerifierHistory</key>
			<array>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeNative:KerberosKeys</key>
			<array>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
            <key>dsAttrTypeNative:HeimdalSRPKey</key>
            <array>
                <dict>
                    <!-- only allow UID 0 to see and change values -->
                    <key>uuid</key>
                    <string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
                    <key>permissions</key>
                    <array>
                        <string>readattr</string>
                        <string>writeattr</string>
                    </array>
                </dict>
            </array>
			<key>dsAttrTypeStandard:AuthenticationAuthority</key>
			<array>
				<dict>
					<!-- anonymous can read with entitlement -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
					<key>entitlements</key>
					<array>
						<string>com.apple.private.opendirectoryd.identity</string>
					</array>
				</dict>
				<dict>
					<!-- owner can read -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- owner based on EUID can read -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
					<key>use-euid</key>
					<true/>
				</dict>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can read and modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeStandard:AuthenticationHint</key>
			<array>
				<dict>
					<!-- anonymous can read with entitlement -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
					<key>entitlements</key>
					<array>
						<string>com.apple.private.opendirectoryd.auth-hint</string>
					</array>
				</dict>
				<dict>
					<!-- with authentication, the owner can write -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>writeattr</string>
					</array>
					<key>authentication-rights</key>
					<array>
						<string>com.apple.opendirectoryd.auth-hint</string>
					</array>
				</dict>
				<dict>
					<!-- owner can read -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can read and modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeStandard:GeneratedUID</key>
			<array>
				<dict>
					<!-- anonymous can read -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
					<!-- no one can write.  user GUIDs are immutable -->
				</dict>
			</array>
			<key>dsAttrTypeNative:LinkedIdentity</key>
			<array>
				<dict>
					<!-- anonymous can read with entitlement -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
					<key>entitlements</key>
					<array>
						<string>com.apple.private.opendirectoryd.identity</string>
					</array>
				</dict>
				<dict>
					<!-- with authentication, the owner can write -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>writeattr</string>
					</array>
					<key>authentication-rights</key>
					<array>
						<string>com.apple.opendirectoryd.linkidentity</string>
					</array>
				</dict>
				<dict>
					<!-- owner can read -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can read and modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeStandard:RealName</key>
			<array>
				<dict>
					<!-- anonymous can read -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeStandard:UserShell</key>
			<array>
				<dict>
					<!-- anonymous can read -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- with authentication, the owner can write -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000A</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeNative:AutoGrantSecureToken</key>
			<array>
				<dict>
					<!-- root can modify if they have the entitlement -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>writeattr</string>
					</array>
					<key>entitlements</key>
					<array>
						<string>com.apple.private.opendirectoryd.securetoken</string>
					</array>
				</dict>
			</array>
		</dict>
		<key>dsRecTypeStandard:Computers</key>
		<dict>
			<key>dsAttrTypeNative:ShadowHashData</key>
			<array>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
			<key>dsAttrTypeNative:KerberosKeys</key>
			<array>
				<dict>
					<!-- allow wheel even though it's implicit -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
						<string>writeattr</string>
					</array>
				</dict>
			</array>
            <key>dsAttrTypeNative:HeimdalSRPKey</key>
            <array>
                <dict>
                    <!-- only allow UID 0 to see and change values -->
                    <key>uuid</key>
                    <string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000</string>
                    <key>permissions</key>
                    <array>
                        <string>readattr</string>
                        <string>writeattr</string>
                    </array>
                </dict>
            </array>
		</dict>
		<key>dsRecTypeStandard:SharePoints</key>
		<dict>
			<key>dsAttributesAll</key>
			<array>
				<dict>
					<!-- anonymous can read -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>readattr</string>
					</array>
				</dict>
				<dict>
					<!-- anonymous can modify with entitlement -->
					<key>uuid</key>
					<string>FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000063</string>
					<key>permissions</key>
					<array>
						<string>writeattr</string>
						<string>create</string>
						<string>delete</string>
					</array>
					<key>entitlements</key>
					<array>
						<string>com.apple.private.opendirectoryd.sharepoints</string>
					</array>
				</dict>
				<dict>
					<!-- admin users can modify -->
					<key>uuid</key>
					<string>ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050</string>
					<key>permissions</key>
					<array>
						<string>writeattr</string>
						<string>create</string>
						<string>delete</string>
					</array>
				</dict>
			</array>
		</dict>
	</dict>
</plist>
