> On 17 Feb 2020, at 12:19, Grant Byers <grant.by...@aarnet.edu.au> wrote: > > Hi, > > In an effort to tighten search and read permissions on our internal > directory server, we've limited accounts to read certain attributes of > "self". They have search on the entire tree, but otherwise no read > perms. This is all well and good for clients that utilize the memberOf > attribute of self, but not so good for applications that utilize > memberUid, or insist on searching for groupOfUniqueNames or > groupOfNames then enumerating them programmatically to determine which > groups the user belongs to after binding as the user. > > So. I've been reading docs and haven't been able to find anything, but I > was wanting to do something like this; > > > dn: ou=groups,dc=example,dc=com > aci: (targetattr = "*") > (targetfilter = "(&(objectClass=groupOfUniqueNames)(uniqueMember={{rdn > of self}})") > (version 3.0; acl "Allow authenticated users to read own group > membership"; allow (read,compare,search) > (userdn="ldap:///all");) > > > where the target filter limits results to only those that match > uniqueMember={{rdn of self}} > > > Is this possible?
Yes, but I'd suggest you tighten it up a bit. targetattr = * is really dangerous, it really means everything, including internal system attributes. You probably want "(targetattr = "objectClass || uniquemember || cn || memberUid || member || memberOf")(targetfilter = "....") There is a section in the redhat ds guide that may help a lot https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html/administration_guide/managing_access_control In general, keep your aci's as targeted and as specific as possible. I'm very happy to review these further if you need :) > > > Thanks, > Grant > _______________________________________________ > 389-users mailing list -- 389-users@lists.fedoraproject.org > To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org