(ITS#8519) Mahesh

[maheshwar.reddy@secure-24.com]

Full_Name: Maheshwar Reddy
Version: 2.4.4
OS: CentOS 6.5
URL: ftp://ftp.openldap.org/incoming/Mahesh
Submission from: (NULL) (175.101.6.130)


Dear Openldap Support,

First of all thank for the open community, We have been using openldap since
last 5 years. 

Right now we are trying to decommission older version of openldap and trying to
build newversion. Prior to that we are testing the openldap functionality and we
observed some issue while configuring.

We have a Linux team, and they all are need ldap write access. I've created a
group and provided a ldap write access to that group. But the people who belongs
to that group they were unable to write the ldiff files. 

Attached information, kindly take look into it. 

you help would highly appreciated. 


# ldap_writers, access_control, redhot, redhot.com
dn: cn=ldap_writers,ou=access_control,o=redhot,dc=redhot,dc=com
cn: ldap_writers
objectClass: organizationalRole
description: Grants full LDAP write access
roleOccupant: uid=maheshwar.reddy,ou=users,o=redhot,dc=redhot,dc=com


[root@sal-lnx01 ~]# cat grantaccess.ldif
dn: olcDatabase={2}bdb,cn=nonfig
changetype: modify
add: olcAccess
olcAccess: to * by group/organizationalRole/roleOccupant="cn=ldap_writers,ou=access_control,o=redhot,dc=redhot,dc=com"
write


[root@sal-lnx01 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f grantaccess.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}bdb,cn=config"


[root@sal-lnx01 ~]# slapcat -n0 | tail -n10
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=redhot,dc=com" write by * read
olcAccess: {3}to * by group/organizationalRole/roleOccupant="cn=ldap_writers
 ,ou=access_control,o=redhot,dc=redhot,dc=com" write
olcSuffix: dc=redhot,dc=com
olcRootDN: cn=Manager,dc=redhot,dc=com
entryCSN: 20161017124350.966527Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20161017124350Z

[root@sal-lnx01 ~]# ldapadd -x -W -D
uid=maheshwar.reddy,ou=users,o=redhot,dc=redhot,dc=com -f test.ldif
Enter LDAP Password:
adding new entry "uid=srikanth.reddy,ou=users,o=redhot,dc=redhot,dc=com"
ldap_add: Insufficient access (50)
        additional info: no write access to parent

[root@sal-lnx01 ~]# cat test.ldif
# srikanth.reddy, users, redhot.com
dn: uid=srikanth.reddy,ou=users,o=redhot,dc=redhot,dc=com
cn: Maheshwar
objectClass: organizationalPerson
objectClass: person
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
givenName: Maheshwar Reddy
homeDirectory:2F2Fhome/srikanth.reddy
loginShell: /bin/bash
mail: srikanth.reddy@redhot.com
sn: Reddy
uid: srikanth.reddy
uidNumber: 10001
gidNumber: 1000
userPassword: {SSHA}UQU2j5vBuGqjfTE3x+UlA2Ez1ENHAZ/Q