On 04/09/2009 12:02, Tomasz Chmielewski wrote:
I would like to allow a user to edit everything in a given subtree.
For example, I would like to allow
uid=Operator,ou=Users,dc=example,dc=com to edit all entries which are in
*,ou=Users,dc=example,dc=com.
I tried to follow http://www.zytrax.com/books/ldap/ch6/#access to set up
access for that user, but I keep getting "insufficient access".
onn=5 fd=15 ACCEPT from IP=127.0.0.1:46917 (IP=0.0.0.0:389)
conn=5 op=0 BIND dn="uid=Operator,ou=Users,dc=example,dc=com" method=128
conn=5 op=0 BIND dn="uid=Operator,ou=Users,dc=example,dc=com"
mech=SIMPLE ssf=0
conn=5 op=0 RESULT tag=97 err=0 text=
conn=5 op=1 DEL dn="uid=d.user3,ou=Users,dc=example,dc=com"
conn=5 op=1 RESULT tag=107 err=50 text=no write access to entry
My rule in slapd.conf is:
access to dn="ou=Users,dc=example,dc=com"
by dn="uid=Operator,ou=Users,dc=example,dc=com" write
by dn="uid=Operator,ou=Users,dc=example,dc=com" read
I also tried to use:
access to dn.subtree="ou=Users,dc=example,dc=com"
...
But then I'm not even able to connect.
Hi,
I recommend that you read the chapter on access control from the
*OpenLDAP* admin guide:
http://www.openldap.org/doc/admin24/access-control.html
In this particular case, I expect that you have other access rules that
may be blocking this one - remember that order is important, and the
first rule matching on the <what> part will define the access level.
Help in setting up ACLs is available through two other means:
1) If you use the command line ldap* tools, they often output some
additional info along with the error 50, like this:
ldap_delete: Insufficient access (50)
additional info: no write access to parent
2) You can enable loglevel acl in your configuration file and check the
logs to see which rules are being used.
I hope this helps. If you have further questions, don't hesitate to post
back here with your full set of ACLs, and information on the version of
slapd you're using.
Regards,
Jonathan
