<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">Hi Simo, Simo Sorce wrote: </div> <blockquote cite="mid:1389374283.26102.284.camel@willson.li.ssimo.org" type="cite"> <pre wrap="">On Fri, 2014-01-10 at 12:15 -0500, Simo Sorce wrote: </pre> <blockquote type="cite"> <pre wrap="">This is not what I had in mind, our use cases is something like this: aci: (target=<a class="moz-txt-link-freetext" href="ldap:///dc=bar">ldap:///dc=bar</a>)(targetattr=*) (version 3.0; acl "userattr test"; allow (add) userattr = "managedby#USERDN";) ldapmodify -D uid=user,dc=bar ... <<EOF </pre> </blockquote> </blockquote> <pre wrap="">dn: cn=somobj,dc=bar ... managedby: uid=user,dc=bar</pre> <blockquote cite="mid:1389374283.26102.284.camel@willson.li.ssimo.org" type="cite"> <pre wrap=""> ^^^^^^^^ Sorry this should have been ldapadd. Simo.</pre> </blockquote> Yes, it works. aci: (target=<a class="moz-txt-link-freetext" href="ldap:///o=my.com">ldap:///o=my.com</a>)(targetattr=*) (version 3.0; acl "userattr test" ; allow (add,write,delete,read,search,compare) userattr = "description#USERDN";) $ ldapmodify ... -D 'uid=nuser0,o=my.com' -w Nuser0 -a << EOF dn: uid=Nuser6, o=my.com ... description: uid=nuser0,o=my.com EOF $ ldapsearch... -b "o=my.com" "(uid=nuser6)" description dn: uid=Nuser6,o=my.com description: uid=nuser0,o=my.com # delete uid=nuser6 # attempt to add the entry by other user fails: $ ldapmodify ... -D 'uid=nuser1,o=my.com' -w Nuser1 -a << EOF dn: uid=Nuser6, o=my.com ... description: uid=nuser0,o=my.com EOF ldap_add: Insufficient access ldap_add: additional info: Insufficient 'add' privilege to the 'userPassword' attribute <blockquote cite="mid:1389374283.26102.284.camel@willson.li.ssimo.org" type="cite"> <pre wrap=""> </pre> <blockquote type="cite"> <pre wrap="">dn: cn=somobj,dc=bar ... managedby: uid=user,dc=bar This should succeed, however if managedby includes anything but "uid=user,dc=bar" it should fail. </pre> <blockquote type="cite"> <blockquote type="cite"> <blockquote type="cite"> <blockquote type="cite"> <pre wrap="">Will it allow the user to add multiple values to the same attr as long as one of the is the userDN ? O will it restrict that case ? </pre> </blockquote> </blockquote> <pre wrap="">This is also important, if attrFoo is a multivalued attribute, does this option allow any values to be set as long as one of them is userDN ? Or will it enforce that *only* userDN is add in the add operation ? </pre> </blockquote> <pre wrap="">As long as the type of the attribute is not restricted as DN syntax, it takes any value including DN. I tested with 'description' (e.g., userattr = "description#USERDN") and verified it takes userDN as well as any other values. $ ldapmodify ... -D 'cn=directory manager' -w <pw> dn: uid=nuser4,o=my.com changetype: modify add: description description: uid=nuser4,o=my.com $ ldapmodify ... -D 'uid=nuser4,o=my.com' -w Nuser4 dn: uid=nuser4,o=my.com changetype: modify add: description description: uid=nuser0,o=my.com modifying entry uid=nuser4,o=my.com $ ldapmodify ... -D 'uid=nuser0,o=my.com' -w Nuser0 dn: uid=nuser4,o=my.com changetype: modify add: description description: uid=nuser1,o=my.com modifying entry uid=nuser4,o=my.com $ ldapmodify ... -D 'uid=nuser1,o=my.com' -w Nuser1 dn: uid=nuser4,o=my.com changetype: modify add: description description: value $ ldapsearch ... -D 'cn=directory manager' -w <pw> -b "uid=nuser4,o=my.com" description dn: uid=Nuser4,o=my.com description: uid=nuser4,o=my.com description: uid=nuser0,o=my.com description: uid=nuser1,o=my.com description: value </pre> </blockquote> <pre wrap=""> If I read this correctly, and I am not 100% sure yet, it seem to me this is exactly the opposite of what IPA needs. Our need is that uid=userX,... can only write its own DN as value or the attributes we are allowing through userattr.</pre> </blockquote> </blockquote> You want to allow this $ ldapmodify ... -D 'uid=userX,o=my.com' -w userX << EOF dn: uid=userY,o=my.com changetype: modify replace: managedby managedby: uid=userX,o=my.com EOF But NOT allow this? $ ldapmodify ... -D 'uid=userX,o=my.com' -w userX << EOF dn: uid=userY,o=my.com changetype: modify replace: managedby managedby: uid=userZ,o=my.com EOF I don't think we have the control there... --noriko </body> </html>