[Fedora-directory-users] ACI help

[Rich Megginson]

Craig White wrote:
> On Tue, 2008-09-02 at 09:59 -0600, Rich Megginson wrote:
>   
>> Rich Megginson wrote:
>>     
>>> Craig White wrote:
>>>       
>>>> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:
>>>>  
>>>>         
>>>>> I have users personal address books as an ou under their accounts...
>>>>>
>>>>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com
>>>>>
>>>>> but when I try to add an entry, I am blocked...
>>>>>
>>>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD
>>>>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" 
>>>>>
>>>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105
>>>>> nentries=0 etime=0
>>>>>
>>>>> I need an ACi that allows each uid account to read/write entries in 
>>>>> OU's
>>>>> under their own accounts and the only ACi's I have are the ones
>>>>> inherited
>>>>>     
>>>>>           
>>>> ----
>>>> It would be great if I could get some help here.
>>>>   
>>>>         
>>> The ACL Summary error log level can provide some clues.  
>>> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
>>>       
>>>> I know that in OpenLDAP, ACL's are processed top down and so I'm looking
>>>> at the ACi's that would govern here.
>>>>
>>>> dc=example,dc=com has the following ACI (the second one after anonymous
>>>> access)...
>>>>
>>>> (targetattr = "carLicense ||description ||displayName  
>>>> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress 
>>>> ||initials  ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo  
>>>> ||postOfficeBox ||postalAddress ||postalCode 
>>>> ||preferredDeliveryMethod  ||preferredLanguage ||registeredAddress 
>>>> ||roomNumber ||secretary  ||seeAlso ||st ||street ||telephoneNumber 
>>>> ||telexNumber ||title  ||userCertificate ||userPassword 
>>>> ||userSMIMECertificate  ||x500UniqueIdentifier")
>>>> (version 3.0;
>>>> acl "Enable self write for common attributes";
>>>> allow (write)
>>>> (userdn = "ldap:///self")
>>>> ;)
>>>>
>>>> and I added one more (it's on the bottom of the list - #7)...
>>>>
>>>> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow  
>>>> (write)(userdn = "ldap:///self");)
>>>>         
>> Have you tried the "add" right, to allow users to add entries under 
>> their entries?
>> *http://tinyurl.com/3yo88r*
>>
>>  I'm not sure if self will work here - you might have to use a macro ACI 
>> in which the uid part of the target matches the uid part of the subject 
>> - see
>> http://tinyurl.com/59ehxh
>>     
> ----
> I'm not sure if 'self' will work here either...nothing seems to work.
>
> This is the ACL that works for me in OpenLDAP...
>
> access to
> dn.regex="^ou=AddressBook,uid=([^,]+),ou=People,dc=example,dc=com$$"
>         attrs=children,entry,inetOrgPerson,organizationalPerson
>         by dn.exact,expand="uid=$1,ou=People,dc=example,dc=com" write
>         by dn.exact="uid=administrator,ou=People,dc=example,dc=com"
> write
>         by * none
>
>   
This looks like a macro ACI.  Have you tried a macro ACI in conjunction 
with the "add" right?
> I am hesitant to fool with the access control while there are people
> working on the network but the above is exactly what I want to work in
> Fedora-DS
>
> Craig
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20080902/ec2f420e/attachment.bin>