On Mon, 9 Jul 2007, JOYDEEP wrote:
I have mentioned in my last mail that I had ACL like
################ personal ACL #######################
###################### read #######################
access to
dn.regex="cn=([^,]+),ou=personal,ou=contacts,ou=contacts,virtualDomain=([^,]+),dc=suse,dc=ldap$"
by dn.exact,expand="uid=$1,ou=users,virtualDomain=$2,dc=suse,dc=ldap"
read
by * none
Since that has no control field, it defaults to 'stop', so that checks
that match the <what> clauses (just a dn.regex clause, in this case) will
stop after processing that access directive. Later directives that might
also match will not be processed.
######################## write ############################
access to
dn.regex="cn=([^,]+),ou=personal,ou=contacts,ou=contacts,virtualDomain=([^,]+),dc=suse,dc=ldap"
attr=children,entry,@inetOrgPerson,@posixAccount,@mozillaAbPersonAlpha,@evolutionPerson
by
dn.exact,expand="uid=$1,ou=users,virtualDomain=$2,dc=suse,dc=ldap" write
by users none
(That should be "attrs=children,etc..", as "attr=" is undocumented, though
tolerated by slapd)
the problem if writing was it reports
Jul 9 11:59:33 lvps87-230-8-228 slapd[5147]: => access_allowed: write
access denied by read(=rscx)
So I disabled the read ACL and the problem disappeared.
Right, because the first access directive wasn't letting the processing
reach the second access directive.
However, that second directive only gives access to some of the
attributes, unlike your first access directive which gives access to all
of them. To permit read access to all attributes and write access to only
some then you'll need to access directive, at least one of which has a
control field of 'break'. Whether they both require that depends on
whether later access directives should also be applied to that same DN.
I have a question here that why we need the read ACL at all more over
thing is not so easy for Group ACL.
I cannot parse that sentence at all.
If I follow the same technique for group ACL then though the group has
no delete option it can delete the entries easily.
"delete option"? There isn't a 'delete' access level. To quote the
slapd.access(5) manpage:
The delete operation requires write (=w) privileges on the
pseudo-attribute entry of the entry being deleted, and
write (=w) privileges on the children pseudo-attribute of
the entry's parent.
Note that those are the exact same privileges as are needed to add an
entry. It appears that you can't give someone permission to add an entry
but not delete it.
Philip Guenther
