Re: Ldap configuration (Group permission)

[Miguel <mcm@moviquity.com>]

That is a usefull link. Thank you!
I finally manage this way:


access to dn.Subtree="ou=contacts,ou=people,dc=mcm,dc=com"
	by dn.Subtree="ou=administradores,ou=people,dc=mcm,dc=com" write
	by * read

What I wanted is to create a group of administrator to control everything and a group of normal users with only access control in their groups contacts.

I will also apply the group configuration you send me, thanks!

On Thu, 2009-01-29 at 17:25 +0100, Michael Ströder wrote:
> Miguel wrote:
> > 
> > I m trying to configure the ldap . I have created two groups (contact
> > and administradores) within another one (people).
> > 
> > I would like administradores group to have all the permissions over
> > contacts group. I have modified the slapd.conf in this way, but it
> > doesn't work:
> > 
> > access to dn=".*,ou=contacts,ou=people,dc=mcm,dc=com"
> >        by dn=".*,ou=administradores,ou=people,dc=mcm,dc=com" write
> >        by * read
>
> You should consult the fine FAQ - in particular:
>
> "How do I use groups to manage access control?"
>
> http://www.openldap.org/faq/data/cache/52.html
>
> Ciao, Michael.