[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: regex in group ACL

Hi Pierangelo,

Pierangelo Masarati wrote:

I think I'm missing a few details.

1) Can you show a "real" example (i.e. omit sensitive data, but present a full example of a user, an account and a delegation)?

Here it is :

version: 1

# Entry 1:
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSAMAccount
cn: denis
sn: denis
uid: denis
uidNumber: 1007
gidNumber: 513
homeDirectory: /home/denis
loginShell: /bin/bash
gecos: System User
description: System User
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaKickoffTime: 2147483647
sambaPwdCanChange: 0
displayName: System User
sambaSID: S-1-5-21-3579097732-1377074360-2699113850-3014
sambaPrimaryGroupSID: S-1-5-21-3579097732-1377074360-2699113850-513
sambaLogonScript: denis.cmd
sambaProfilePath: \\SAMBA-PDC\profiles\denis
sambaHomePath: \\SAMBA-PDC\homes\denis
sambaHomeDrive: H:
sambaAcctFlags: [U]
sambaPwdLastSet: 1095433824
sambaPwdMustChange: 1103987424

# Entry 3:
versionNumber: 2
cn: exampleSSOStorageV2
objectClass: exampleSSOStorage

# Entry 4:
cn: W02222226CAPP36UMM4SA4JUG6JURRUVWZ2222222222222222
objectClass: exampleSSOAccount
exampleSSOAccountLoginIdentifier:: NzQ2Zjc0NmY=
exampleApplicationObject: cn=ec871f8b82f24dca81ff296f66dff816,ou=Applications
exampleAccountType: 0
exampleLastUpdateTime: 1096636884

# Entry 5:
exampleExpirationDate: 1097500951
exampleDelegationRightsData: 0
cn: dc0d0c04-a7f4-1028-9b7a-c1ad53990353
objectClass: exampleSSOAccountDelegation
exampleUserEntityObject: uid=francois,ou=Tests FB,dc=example,dc=local

As you can see, the accounts objects are stored as exampleSSOAccount objectClass entries, under an object of class exampleSSOStorage. The delegation objects are of class exampleSSOAccountDelegation

2) For instance, can a user have more than one account?

Yes, he can

3) What does an account's RDN look like?

It is an ID generated by our software, which identifies it by encoding several information, in order to access the object without having to do a search request to retrieve its DN

4) Is the delegation's DN the identity you want to give access rights for the user's entry?

Probably due to the fact that English is not my natural language, I don't understand you.
But I think my LDIF export will be a good explanation.

In this case, the access right rule would be :

access to dn="cn=W02222226CAPP36UMM4SA4JUG6JURRUVWZ2222222222222222,cn=exampleSSOStorageV2,uid=denis,ou=Users,dc=example,dc=local"
by dn="uid=francois,ou=Tests FB,dc=example,dc=local" read

Indeed, I want a more generic rule :) and since "uid=francois,ou=Tests FB,dc=example,dc=local" is stored in the exampleSSOAccountDelegation object through its exampleUserEntityObject attribute :

access to dn="cn=W02222226CAPP36UMM4SA4JUG6JURRUVWZ2222222222222222,cn=exampleSSOStorageV2,uid=denis,ou=Users,dc=example,dc=local"
by group="cn=dc0d0c04-a7f4-1028-9b7a-c1ad53990353,cn=W02222226CAPP36UMM4SA4JUG6JURRUVWZ2222222222222222,cn=exampleSSOStorageV2,uid=denis,ou=Users,dc=example,dc=local" read

(Where 'group' has to be replaced with 'group/exampleSSOAccountDelegation/exampleUserEntityObject')

But here it only works for one account of one user, so the very generic rule would be :

access to filter="(objectClass=exampleSSOAccount)" dn.regex="(.*)"
   by group.regex="(.*),$1" read

But this doesn't work (see my previous posts)

Important precision : *One delegation object is created of each user which the account is delegated to*. So there can be several exampleSSOAccountDelegation objects under one exampleSSOAccount object. And there is only one value of exampleUserEntityObject in a exampleSSOAccountDelegation entry.

So maybe I could find a way with dnattr... but I don't find one

Thank you for your help



   SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497