[389-users] Re: Limiting access to same ou

2018-11-27 Thread Alistair Cunningham
On 28/11/2018 12:08, Mark Reynolds wrote: On 11/27/18 7:24 PM, Alistair Cunningham wrote: I've added these acis, but a telephone (with objectClass 'person') in tenant1 can still see people (with objectClass 'inetOrgPerson') in tenant2. Presumably there needs to also be a blanket aci to forbid

[389-users] Re: Limiting access to same ou

2018-11-27 Thread Mark Reynolds
On 11/27/18 7:24 PM, Alistair Cunningham wrote: I've added these acis, but a telephone (with objectClass 'person') in tenant1 can still see people (with objectClass 'inetOrgPerson') in tenant2. Presumably there needs to also be a blanket aci to forbid all telephones from viewing other

[389-users] Re: Limiting access to same ou

2018-11-27 Thread Alistair Cunningham
I've added these acis, but a telephone (with objectClass 'person') in tenant1 can still see people (with objectClass 'inetOrgPerson') in tenant2. Presumably there needs to also be a blanket aci to forbid all telephones from viewing other tenants, that these tenant-specific allow acis then

[389-users] Re: Limiting access to same ou

2018-11-27 Thread Alistair Cunningham
On 27/11/2018 15:05, Mark Reynolds wrote: I see, thank you. In that case, what DN should I use instead of "cn=1234567890,ou=2,dc=integrics,dc=com" for this simpleSecurityObject? If no DN, how do I specify the simpleSecurityObject's username? You should add an objectclass that allows CN (or