[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Help with ACL's for Users/Groups
Here is how my client is binding...
Base DN
o=Home,ou=AddressBooks,dc=Mycompany,dc=com
Bind DN
cn=Me,ou=Users,dc=MyCompany,dc=com
I am a member of the Home group
dn: o=Home,ou=Groups,dc=MyCompany,dc=com
objectclass: top
objectclass: groupOfNames
cn: Home
member: cn=Me,ou=Users,dc=MyCompany,dc=com
I wanted to send this out, to show you how I was binding witht the client...
I'll turn on the logging for ACL parsing like you suggested.
--On Thursday, July 31, 2008 9:11 AM -0400 "Chris G. Sellers"
<chris.sellers@nitle.org> wrote:
> I think your ACLs are not allowing you to do what you want, but I can't
> say for sure without knowing how your client is binding to your
> directory.
>
> If you turn on openldap's logging for ACL parsing, you should see the
> connection and if it was allowed or denied for the given bind.
>
> ( 128 (0x80 ACL) access control list processing
> : see man slapd.conf for details under loglevel )
>
> Give that a try, and then you should be able to relax or adjust your
> ACLs to allow access.
>
> I hope that helps
> Sellers
>
> On Jul 30, 2008, at 10:42 PM, david stackis wrote:
>
>> Hi -
>>
>> First off, I want to apologize for posting to list when I really
>> should
>> have read more.
>> Tonight I read all of Chapter 7.4 in the OpenLDAP Software 2.4 Admin
>> Guide....and I'm still scratching my head wondering why this isn't
>> working.
>>
>> Here's my structure...
>> I have two Groups..."Home", and "Work"
>> I have two Users..."Me", and "You" These users have passwords
>>
>> I can search my LDAP using the rootdn, and I'm able to add to each
>> of the
>> Group AddressBooks "Home", and "Group" using the rootdn. What I
>> can't seem
>> to do, is have user "Me" or "You" access any of the AddressBooks.
>>
>> The user "Me" has access to "Home and "You" has access to "Work"
>> each have
>> two different email addresses.
>>
>> Again...the rootdn can see everything in Thunderbird...but it's "Me"
>> and
>> "You" that seem to have no access/
>> Could someone please point me in the right direction.
>>
>> I'm also using Apache Directory Studio, and I verified that the four
>> entries I added...two being place in the "Home" AddressBook, and the
>> other
>> two in the "Work" AddressBook. The ACL's I'm using are below...and
>> further
>> down is my LDIF I used to create my structure.
>>
>> I've tried attrs=userPassword, and attr=userPassword...I've seen
>> both of
>> these examples used
>>
>> Thank you for any help.
>>
>> # ACL1
>> access to attrs=userPassword
>> by self write
>> by anonymous auth
>> # ACL2
>> access to dn.regex="o=(.+),ou=AddressBooks,dc=MyCompany,dc=com"
>> by group.expand="cn=$1,ou=Groups,dc=MyCompany,dc=com" write
>> # ACL3
>> access to dn.base="ou=AddressBooks,dc=MyCompany,dc=com" by * read
>> access to dn.base="" by * read
>> # ACL4
>> access to dn.base="cn=Subschema" by * read
>> # ACL5
>> disallow bind_anon
>>
>> The LDIF I used...
>> # Initialize the suffix entry defined in slapd.conf
>> #
>> dn: dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organization
>> objectclass: dcObject
>> dc: MyCompany
>> o: cctr
>>
>> #
>> # Initialize the AddressBooks heirarchy
>> #
>> dn: ou=AddressBooks,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organizationalUnit
>> ou: AddressBooks
>>
>> #
>> # Define individual address books
>> #
>> dn: o=Home,ou=AddressBooks,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organization
>> o: Home
>>
>> dn: o=Work,ou=AddressBooks,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organization
>> o: Work
>>
>> #
>> # Initialize the Users heirarchy
>> #
>> dn: ou=Users,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organizationalUnit
>> ou: Users
>>
>> #
>> # Define individual users
>> #
>> dn: cn=Me,ou=Users,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: person
>> cn: Me
>> sn: My LastName
>> userPassword: {crypt}XXXXXX
>>
>> dn: cn=You,ou=Users,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: person
>> cn: You
>> sn: You LastName
>> userPassword: {crypt}XXXXXX
>>
>> #
>> # Initialize the Groups heirarchy
>> #
>> dn: ou=Groups,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: organizationalUnit
>> ou: Groups
>>
>> #
>> # Group users into separate address books
>> #
>> dn: o=Home,ou=Groups,dc=MyCompany,dc=com
>> objectclass: top
>> objectclass: groupOfNames
>> cn: Home
>> member: cn=Me,ou=Users,dc=MyCompany,dc=com
>>
>> dn: o=Work,ou=Groups,dc=ucsb,dc=edu
>> objectclass: top
>> objectclass: groupOfNames
>> cn: Work
>> member: cn=You,ou=Users,dc=MyCompany,dc=com
>>
>>
>> -------------------
>> david stackis
>>
>
> ++++++++++++++++++++++++++++++++++++++
> Chris G. Sellers | Internet Engineer | NITLE
> 734.661.2318 | chris.sellers@nitle.org
> Jabber: csellers@nitle.org | AIM: imthewherd
>
-------------------
david stackis
uc santa barbara
phone: 805-893-8286
http://isc.ucsb.edu