show ACL
node node1
property enable-acl=true
primitive st stonith:ssh \
	params hostlist='node1' \
	meta target-role="Started" requires=nothing \
	op start timeout=60s \
	op monitor interval=60m timeout=60s
primitive d0 ocf:pacemaker:Dummy
primitive d1 ocf:pacemaker:Dummy
role basic-read \
       read status \
       read type:node attribute:uname \
       read type:node attribute:type \
       read property
role basic-read-basic \
	read cib
role d0-admin \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	read ref:d0
role silly-role \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	read ref:d0 \
	read status \
	read type:node attribute:uname \
	read type:node attribute:type \
	read utilization:d0 \
	read property:stonith-enabled \
	write property \
	read node \
	read node:node1 \
	read nodeattr \
	read nodeattr:a1 \
	read nodeutil \
	read nodeutil:node1 \
	read status \
	read cib
role silly-role-two \
	read xpath:"//nodes//attributes" \
	deny tag:nvpair \
	deny ref:d0
acl_target alice \
	basic-read-basic
acl_target bob \
	d0-admin \
	basic-read-basic
role cyrus-role \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	read ref:d0 \
	read status \
	read type:node attribute:uname \
	read type:node attribute:type \
	read property
acl_target cyrus cyrus-role
_test
verify
.