aci

["Raghu Babu" <rmovva@waterford.org>]

Hi all,

       i have configured my openldap server using following document for
aci.
       but iam not able to authenticate using only aci in a specific entry.

      http://www.openldap.org/faq/data/cache/634.html

    The sample entry file for a use in ldap as follows,

dn: uid=ryagnik, ou=People, o=waterford.org
givenName: Rishi
sn: Yagnik
userPassword:: e2NyeXB0fSQxJHVaM0ZdadadaDRueGYwdjMza0dna2dHcy9pei4=
loginShell: /bin/bash
uidNumber: 516
gidNumber: 100
mail: ryagnik@waterford.org
shadowMax: 99999
krbName: ryagnik@WATERFORD.ORG
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: kerberosSecurityObject
objectClass: shadowAccount
objectClass: openLDAPacl
uid: ryagnik
gecos: Rishi Yagnik
OpenLDAPaci: 1#entry#grant;r,w,s,c;[all]#group#ou=people,o=waterford.org
shadowLastChange: 11452
cn: Rishi Yagnik
homeDirectory: /home/ryagnik

---------------------------------------slapd.conf sample file is as follows

# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.4 2000/08/26 17:06:18
kur
t Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/nis.schema
include
/usr/local/etc/openldap/schema/redhat/rfc822-MailMember.schema
include         /usr/local/etc/openldap/schema/redhat/autofs.schema
include         /usr/local/etc/openldap/schema/redhat/kerberosobject.schema
include         /usr/local/etc/openldap/schema/samba.schema
# Define global ACLs to disable default read access.

include        /usr/local/etc/openldap/access.conf

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.or
#pidfile        /var/run/slapd.pid
#argsfile       /var/run/slapd.args

# Load dynamic backend modules:
# modulepath    /usr/sbin/openldap
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# To allow TLS-enabled connections, create /usr/share/ssl/certs/slapd.pem
# and uncomment the following lines.
# TLSCertificateFile /usr/share/ssl/certs/slapd.pem
# TLSCertificateKeyFile /usr/share/ssl/certs/slapd.pem
sockbuf_max_incoming            10240000
sockbuf_max_incoming_auth       10240000
#######################################################################
# ldbm database definitions
#######################################################################

database        ldbm
suffix          "o=waterfsuffix          "o=waterford.org"
#suffix         "o=My Organization Name, c=US"
rootdn          "cn=Manager, o=waterford.org"
#rootdn         "cn=Manager, o=My Organization Name, c=US"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw                xyzzz
# The database directory MUST exist prior to running slapd AND
# should only be accessable by the slapd/tools. Mode 700 recommended.
directory       /var/lib/ldap

# openldap tunning
schemacheck off
cachesize 10000
dbcachesize 100000
sizelimit 10000
loglevel 0
dbcacheNoWsync


# Indices to maintain
#index  objectClass                             eq
index   objectClass,uid,uidNumber,gidNumber     eq
index   cn,mail,surname,givenname               eq,subinitial
access to *
       by dn="cn=Manager,o=waterford.org" write
       by aci write

------------------------------access.conf---------------------------
access to *
       by dn="cn=Manager,o=waterford.org" write
       by aci write


problem:  when i trying to login using ryagnik to ldap server it gives
insufficient access rights

Regards,

Raghu