Re: access control help

["Tiefnig Daniel" <daniel.tiefnig@infonova.at>]

David Olivier some time wrote:
>> access to attr=userPassword
>> by self write
>> by anonymous auth
>> by dn="cn=Admin,dc=orderrace,dc=com" write
>> by * none
>> access to dn.regex=".*,cn=(.*),dc=orderrace,dc=com"
>> by dn.regex=".*,cn=$1,dc=orderrace,dc=com" write
>> by * none

i guess, your user will have a problem here reading it's own entry. 
(when specifying '.*,cn=(.*)') try to leave the ',' away in the regex 
and you should get access to the entry itself too, not only the subtree:

access to dn.regex=".*cn=(.*),dc=orderrace,dc=com"
  by dn.regex="cn=$1,dc=orderrace,dc=com" write
  by * none

this gives your 'cn=<something>,dc=orderrace,dc=com'-users write access 
to "their" subtree. if you want to allow subtree entries also to write 
the subtree, add a '.*' in front of the second dn.regex too.

not sure wether this works, but it looks logical to me..

daniel

Peter Lüders wrote:

> hello,
>
> thanks for your reply.but it dont works as it should: if i login e.g. with 'cn=user1,dc=orderrace,dc=com' i see no data, neither the own nor other subtrees. searches
> return alsways 0 entries.i have openldap server version 2.0.7 installed. may this be the problem ?
>
> for the first it would also help me if i had an explicit  access-rule for every user in sldap.conf. how should the access rule e.g. for 'cn=user1,dc=orderrace,dc=com'
> look like, so that this users has read/write access only to its subtree ?
>
> best regards,
> p.lüders
-- snip --


_________________________________________
Tiefnig Daniel
Server-Technology

INFONOVA IT GesmbH
Seering 6, A-8141 Unterpremstätten
AUSTRIA

E-Mail: mailto:daniel.tiefnig@infonova.at
Web: http://www.infonova.at