[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries

On 22/3/2012 3:56 ÎÎ, Nick Milas wrote:


On 22/3/2012 2:20 ÎÎ, btb wrote:
i press the enter key on my keyboard 

Thanks,

Interestingly, I found that the same is also possible with JXPlorer.
ACLs can be formatted like that and they remain formated. They also function without problems. 

Hi,
I am returning to an older thread, regarding the formatting of ACLs using Carriage Return (CRs) and spaces.
I have just realized that if we format (using CRs) ACLs stored as olcAccess attr values, then they are exported/stored as ldif in base64 encoded format (by all clients I tried). 

Here is an example:
olcAccess: {25}to dn.subtree="ou=dns1,dc=noa,dc=gr" by group/groupOfNames/member.exact="cn=techadmins,ou=groups,dc=noa,dc=gr" write by group/groupOfNames/member.exact="cn=spaceadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=astroadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=geinadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=meteoadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=nestoradmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=guestadmins,ou=groups,dc=noa,dc=gr" read by dn.base="uid=dnsauthusr,ou=system,dc=noa,dc=gr" read olcAccess:: ezI2fXRvIGRuLnN1YnRyZWU9Im91PWtyYmNvbnRhaW5lcixkYz1ub2EsZGM9Z3Ii 
 ICBhdHRycz1jaGlsZHJlbixlbnRyeQogICBieSBkbi5iYXNlPSJ1aWQ9ZG5zYXV0aHVzcixvdT1
 zeXN0ZW0sZGM9bm9hLGRjPWdyIiBub25lICAKICAgYnkgZ3JvdXAvZ3JvdXBPZk5hbWVzL21lbW
 Jlci5leGFjdD0iY249dGVjaGFkbWlucyxvdT1ncm91cHMsZGM9bm9hLGRjPWdyIiB3cml0ZSAgC
 iAgIGJ5IGdyb3VwL2dyb3VwT2ZOYW1lcy9tZW1iZXIuZXhhY3Q9ImNuPXNwYWNlYWRtaW5zLG91
 PWdyb3VwcyxkYz1ub2EsZGM9Z3IiIHJlYWQgIAogICBieSBncm91cC9ncm91cE9mTmFtZXMvbWV
 tYmVyLmV4YWN0PSJjbj1hc3Ryb2FkbWlucyxvdT1ncm91cHMsZGM9bm9hLGRjPWdyIiByZWFkIC
 AKICAgYnkgZ3JvdXAvZ3JvdXBPZk5hbWVzL21lbWJlci5leGFjdD0iY249Z2VpbmFkbWlucyxvd
 T1ncm91cHMsZGM9bm9hLGRjPWdyIiByZWFkICAKICAgYnkgZ3JvdXAvZ3JvdXBPZk5hbWVzL21l
 bWJlci5leGFjdD0iY249bWV0ZW9hZG1pbnMsb3U9Z3JvdXBzLGRjPW5vYSxkYz1nciIgcmVhZCA
 gCiAgIGJ5IGdyb3VwL2dyb3VwT2ZOYW1lcy9tZW1iZXIuZXhhY3Q9ImNuPW5lc3RvcmFkbWlucy
 xvdT1ncm91cHMsZGM9bm9hLGRjPWdyIiByZWFkICAKICAgYnkgZ3JvdXAvZ3JvdXBPZk5hbWVzL
 21lbWJlci5leGFjdD0iY249Z3Vlc3RhZG1pbnMsb3U9Z3JvdXBzLGRjPW5vYSxkYz1nciIgcmVh
 ZCAgCiAgIGJ5IGRuLmJhc2U9InVpZD1hdXRoZW50aWNhdGUsb3U9c3lzdGVtLGRjPW5vYSxkYz1
 nciIgcmVhZCAgCiAgIGJ5IGRuLmJhc2U9InVpZD1sb2dpbmF1dGhiaW5kLG91PXN5c3RlbSxkYz
 1ub2EsZGM9Z3IiIHJlYWQgIAogICBieSBkbi5iYXNlPSJ1aWQ9a2RjLXNlcnZpY2Usb3U9c3lzd
 GVtLGRjPW5vYSxkYz1nciIgcmVhZCAgCiAgIGJ5IGRuLmJhc2U9InVpZD1rcmItYWRtLXNlcnZp
 Y2Usb3U9c3lzdGVtLGRjPW5vYSxkYz1nciIgd3JpdGUgIAogICBieSAqICswIGJyZWFr
The former, ACL #25, was not formatted and is exported OK. However, the latter should be #26 and the actual value is as follows (copied from the GUI): 

{26}to dn.subtree="ou=krbcontainer,dc=noa,dc=gr"  attrs=children,entry
   by dn.base="uid=dnsauthusr,ou=system,dc=noa,dc=gr" none
by group/groupOfNames/member.exact="cn=techadmins,ou=groups,dc=noa,dc=gr" write by group/groupOfNames/member.exact="cn=spaceadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=astroadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=geinadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=meteoadmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=nestoradmins,ou=groups,dc=noa,dc=gr" read by group/groupOfNames/member.exact="cn=guestadmins,ou=groups,dc=noa,dc=gr" read 
   by dn.base="uid=authenticate,ou=system,dc=noa,dc=gr" read
   by dn.base="uid=loginauthbind,ou=system,dc=noa,dc=gr" read
   by dn.base="uid=kdc-service,ou=system,dc=noa,dc=gr" read
   by dn.base="uid=krb-adm-service,ou=system,dc=noa,dc=gr" write
   by * +0 break
This actually is causing a serious problem (I would even call it a "*hell situation*"), because we can no more export/view our ACLs as ldif in a legible form. Moreover, we cannot edit this exported ldif and import it back to cover several editing needs. 

Questions:
1. Is there a way we can export ldif, while automatically removing such formatting so that the ldif content is legible/editable as normal text? 2. Is there a way (some command) to automatically remove all CRs wherever they exist in olcAccess values, to avoid editing one by one (in order to remove all CRs)?
[Note: I have indications (though I have not tested sufficiently) that Apache Directory Studio may have problems in handling correctly ACL modifications when some of the olcAccess values are formatted as above. In one case I totally lost inexplicably all ACLs numbered higher than the olcAccess value I was editing. Just a word of caution, although I don't have enough test data at this time.] 

Please advise!

Thanks,
Nick