[Fedora-directory-users] ACI help

[Rich Megginson]

Rich Megginson wrote:
> Craig White wrote:
>> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:
>>  
>>> I have users personal address books as an ou under their accounts...
>>>
>>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com
>>>
>>> but when I try to add an entry, I am blocked...
>>>
>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD
>>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" 
>>>
>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105
>>> nentries=0 etime=0
>>>
>>> I need an ACi that allows each uid account to read/write entries in 
>>> OU's
>>> under their own accounts and the only ACi's I have are the ones
>>> inherited
>>>     
>> ----
>> It would be great if I could get some help here.
>>   
> The ACL Summary error log level can provide some clues.  
> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
>> I know that in OpenLDAP, ACL's are processed top down and so I'm looking
>> at the ACi's that would govern here.
>>
>> dc=example,dc=com has the following ACI (the second one after anonymous
>> access)...
>>
>> (targetattr = "carLicense ||description ||displayName  
>> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress 
>> ||initials  ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo  
>> ||postOfficeBox ||postalAddress ||postalCode 
>> ||preferredDeliveryMethod  ||preferredLanguage ||registeredAddress 
>> ||roomNumber ||secretary  ||seeAlso ||st ||street ||telephoneNumber 
>> ||telexNumber ||title  ||userCertificate ||userPassword 
>> ||userSMIMECertificate  ||x500UniqueIdentifier")
>> (version 3.0;
>> acl "Enable self write for common attributes";
>> allow (write)
>> (userdn = "ldap:///self")
>> ;)
>>
>> and I added one more (it's on the bottom of the list - #7)...
>>
>> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow  
>> (write)(userdn = "ldap:///self");)
Have you tried the "add" right, to allow users to add entries under 
their entries?
*http://tinyurl.com/3yo88r*

 I'm not sure if self will work here - you might have to use a macro ACI 
in which the uid part of the target matches the uid part of the subject 
- see
http://tinyurl.com/59ehxh
>>
>> but still...
>>
>> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND  
>> dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com"  
>> method=128 version=3
>> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97  
>> nentries=0 etime=0  
>> dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com"
>> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD  
>> dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" 
>>
>> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105  
>> nentries=0 etime=0
>>
>> Craig
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>   
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20080902/d6e9d609/attachment.bin>