[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: deleting ACL
OK, but when you access the LDAP server from any other client, how does
the server know the user that is attempting to connect?
Alejandra
At 16:11 14.01.2002 +0100, you wrote:
> Yes, that's what I meant
(sorry if I was not clear!), and yes I thought
> there was no way to separate from add/delete from modify permissions
at the
> attribute level. However, could I specify a single user to
add/delete? How
> can I do that?
I think you should read carefully the slapd.access man page that comes
with HEAD code
http://www.openldap.org/devel/cvsweb.cgi/doc/man/man5/slapd.access.5
or have a look at the FAQ (a bit older, but basically correct)
http://www.openldap.org/faq/data/cache/447.html
because there are so many specific cases you may want to configure
access for. Basically you may want to give access to a specific
set of attributes, which may belong to a specific entry or to a
subtree or to the whole tree. To give a specific user write
permissions you must use its DN.
So an example ACL for attributes regardless of the entry they belong
to is (assuming your dn is
"cn=Alejandra,dc=your,dc=org"):
access to attrs=entry,mail,description
by
dn.exact="cn=Alejandra,dc=your,dc=org" write
by *
read
Note that you need "entry" access to be allowed to write the
attributes
(here write means add/modify/delete)
If you want to give access to the same attributes but only in the
"ou=Foo" subtree:
access to dn.subtree="ou=Foo,dc=your,dc=org"
attrs=entry,mail,description
by
dn.exact="cn=Alejandra,dc=your,dc=org" write
by *
read
You can make this ACL much more powerful by defining a group of
people
with the same access rights and by delegating access to the members
of the group.
Pierangelo.
______________________________________________________________________
Alejandra Moreno Espinar
at rete ag
mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
snail mail: Oberdorfstrasse 2,
P.O. Box 674, 8024 Zurich, Switzerland
voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266 55 88
_____________________________________________________________________