Re: Line breaks in Directory String values

2012-03-23 Thread Howard Chu
Michael Ströder wrote: Nick Milas wrote: On 22/3/2012 2:20 μμ, btb wrote: i press the enter key on my keyboard Interestingly, I found that the same is also possible with JXPlorer. ACLs can be formatted like that and they remain formated. They also function without problems. Unfortunately,

Re: ACLs for children entry

2012-03-23 Thread Natalia
Hi, Thank you very much! I have tried it. First it has not functioned. Then I have taken inaktin in [] and everything functions perfectly. to dn.regex=,(uid=[^,]+,ou=people,dc=example,dc=com)$ by set.expand=[$1]/description [inaktiv] none by group.exact=cn=ldapadmin,dc=example,dc=com

Re: Line breaks in Directory String values

2012-03-23 Thread Michael Ströder
Howard Chu wrote: Michael Ströder wrote: So I'd be interested in hearing one of the core developers confirm that line breaks in those attribute values will always be preserved when added via LDAP. The attribute types in question all have Directory String syntax. But glancing at the RFC

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

2012-03-23 Thread Buchan Milne
On Tuesday, 20 March 2012 12:53:08 Howard Chu wrote: The purpose of cn=config is to support configuration changes on a server without causing any service outage. Supporting Deletes in cn=config is fundamentally opposed to this goal. E.g., deleting an olcDatabase entry cannot be seen as

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

2012-03-23 Thread Michael Ströder
Buchan Milne wrote: On Tuesday, 20 March 2012 12:53:08 Howard Chu wrote: The purpose of cn=config is to support configuration changes on a server without causing any service outage. Supporting Deletes in cn=config is fundamentally opposed to this goal. E.g., deleting an olcDatabase entry

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

2012-03-23 Thread Michael Ströder
Howard Chu wrote: The OpenLDAP Project is only concerned with implementing the low level functionality. If you want a GUI, ask the Apache Directory Studio folks. But back-config's schema has a very high influence. The question is why it's so much easier for GUI clients to directly support

access to ... by Administrator

2012-03-23 Thread stefano
Hi, i've a question. am configuring the ACLs in slapd.conf. is it necessary to specify the Administrator DN in the who field? ex: access to attrs=userPassword by dn=cn=Manager,dc=example,dc=com Do i have to specify it or the administrator has the access right to every attribute?

Re: access to ... by Administrator

2012-03-23 Thread Christian Manal
Am 23.03.2012 10:44, schrieb stefano: Hi, i've a question. am configuring the ACLs in slapd.conf. is it necessary to specify the Administrator DN in the who field? ex: access to attrs=userPassword by dn=cn=Manager,dc=example,dc=com Do i have to specify it or the

Re: access to ... by Administrator

2012-03-23 Thread Nick Milas
On 23/3/2012 11:44 πμ, stefano wrote: Do i have to specify it or the administrator has the access right to every attribute? Quote from: http://www.openldap.org/doc/admin24/access-control.html : Regardless of what access control policy is defined, the rootdn is always allowed full rights

Re: syncrepl and structuralObjectClass operational attribute

2012-03-23 Thread jehan procaccia
Le 22/03/2012 21:24, Marvin Mundry a écrit : Mar 22 17:51:20 ldapz2 slapd[24456]: entry failed schema check: no structuralObjectClass operational attribute could it be related to the fact that the binddn account cannot read all attributes from the master ? sounds like the replication user is

which is the structural object class for posixAccount/shadowAccount?

2012-03-23 Thread stefano
hi, i've a second question: posixAccount and posixShadow are auxiliary objectClasses but i don't understand which is their structural objectclass. i've seen some examples with account object class. is it this one?

Re: which is the structural object class for posixAccount/shadowAccount?

2012-03-23 Thread Ludovic Poitou
Auxiliary objectclasses can be associated with any structural objectclasses. PosixAccount is typically used with Person or inetOrgPerson, as well as Account. Regards, Ludo On Mar 23, 2012, at 17:04 , stefano wrote: hi, i've a second question: posixAccount and posixShadow are auxiliary

nested groups for openldap v2.2

2012-03-23 Thread Utsav Mohata
Hi All, Versions of my software are : OpenLDAP 2.2.13-7.4E Samba : 3.0.10-1.4E.11 I am a newbie trying to implement nested groups for openLDAP. Does the above version of OpenLDAP support nested groups ? I have been trying multiple ways to implement nested groups (1)As per my

Re: Line breaks in Directory String values

2012-03-23 Thread Howard Chu
Michael Ströder wrote: Howard Chu wrote: Michael Ströder wrote: So I'd be interested in hearing one of the core developers confirm that line breaks in those attribute values will always be preserved when added via LDAP. The attribute types in question all have Directory String syntax. But

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

2012-03-23 Thread Howard Chu
Buchan Milne wrote: On Tuesday, 20 March 2012 12:53:08 Howard Chu wrote: The purpose of cn=config is to support configuration changes on a server without causing any service outage. Supporting Deletes in cn=config is fundamentally opposed to this goal. E.g., deleting an olcDatabase entry

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

2012-03-23 Thread Howard Chu
Michael Ströder wrote: Howard Chu wrote: The OpenLDAP Project is only concerned with implementing the low level functionality. If you want a GUI, ask the Apache Directory Studio folks. But back-config's schema has a very high influence. The question is why it's so much easier for GUI clients