Re: ACL issue with dnattr

[Michael Donnelly <donnelly@sendmail.com>]

A little more clarification.

a) The owners are set on children of ou=exampleGroups, not on the OU entry.
b) I cannot remove a child entry when bound with the DN (as stored in 
owner) for that child entry.

Michael Donnelly wrote:

> I've included the following ACL into my slapd.conf file.
>
> access to dn=".*,ou=exampleGroups,dc=([^,]+),dc=([^,]+)"
>        by dnattr=owner write
>        by * read
>
> access to ou=exampleGroups,dc=([^,]+),dc=([^,]+)"
>        by dnattr=owner write
>        by * read
>
>
> With this, I've found no problems editing an existing entry under 
> ou=exampleGroups,dc=foobar,dc=com when bound with the DN of an owner. 
> (No other ACL grants the bound connection any rights other than read.)
>
> However, I am unable to delete the entry when bound as the owner.  I'm 
> running OpenLDAP 2.0.23
>
> Is this a bug?
> Is there a work-around?