Re: root-only configuration

[Peter Mogensen <apm@mutex.dk>]

Mike Malsman wrote:
> On 11.Mar.2009, at 9:32 AM, Peter Mogensen wrote:
> > But limiting cn=config access to ldapi:///  ... no luck.
> >
> > Do someone have a working example of this?
> >
> > /Peter
>
> What does your 'access' directive look like?

access to dn.exact="cn=config"
       by peername.path="/var/run/slapd/ldapi" auth
       by * none


I've used this method before in "normal" databases, to control who can 
become rootdn, but it just won't work for cn=config.
Of course, I have to add a "userPassword" attribute to cn=config.ldif, 
but it seems to be ignored.
I've also tried to create a cn=root,cn=config object, but I have a 
problem finding a schema which is loaded which allows me to set 
userPassword.

If people on this list hadn't said that it was possible, I would 
probably have concluded by now that it is simply not possible to limit 
rootdn access to cn=config to ldapi:///.

/Peter