RE: ACL to create a CRUD to OpenLDAP

[Joe Friedeggs <friedeggs44@hotmail.com>]

> Hi, all
>
> I'm writing a little script to allow some people to manage LDAP users, as a CRUD. I created a user
> uid=crud,ou=Applications,dc=domain,dc=org and I need to allow this user to add, modify and delete users that only belongs to
> ou=FTPUsers,dc=domain,dc=org.
>
> I wrote this ACL in slapd.conf:
>
> access to dn.subtree="ou=FTPUsers,dc=domain,dc=org"
> by dn.exact="cn=Admin,dc=domain,dc=org" write
> by dn.exact="uid=crud,ou=Applications,dc=domain,dc=org" write
> by self write
> by * read
>
> Testing ACL, I had:
>
> [root@svr2021 openldap2.4]# slapacl2.4 -f /etc/openldap2.4/slapd.conf -b "uid=crud,ou=Applications,dc=domain,dc=org" -D
> "uid=ftppinguim,ou=FTPUsers,dc=domain,dc=org" "uid/write:"
> authcDN: "uid=ftppinguim,ou=ftpusers,dc=domain,dc=org"
> write access to uid=: DENIED
>
> So, the ACL is not working. If I ask to uid/read:, I have access allowed.
>
> Later I changed my ACL to dn.children, but the result was the same.
>
> I'm using LDAP 2.4 and I would like to know if somebody already did the same configuration or has tips or docs to read.
>
> Thanks a lot
>

I believe you've simply switched your '-b' (searchbase) and '-D' (binddn).  Should be:

-D uid=crud,ou=Applications,dc=domain,dc=org  -b uid=ftppinguim,ou=FTPUsers,dc=domain,dc=org


Joe
 		 	   		  
_________________________________________________________________
Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_1