[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: regex in group ACL


I (finally) understood your problem (at least I think), and my answer is that currently there's no means to do that even with sets (which are not as magic as I thought, although very versatile). As such, I just extended them in HEAD code to allow subsearches when resolving DNs by means of the URI form. If you have a chance to try HEAD code, the following (yet undocumented) access rule sshould do the trick (just tested with a similar setup of yours):

access to dn.regex=".*,(cn=exampleSSOStorageV2,uid=[^,]+,ou=Users,dc=example,dc=com)$"
by set.expand="[ldap:///$1??subtree?(objectClass=exampleSSOAccountDelegation)]/exampleUserEntityObject & user" read

which means: everything below "cn=exampleSSOStorageV2,uid=[^,]+,ou=Users,dc=example,dc=com"
with arboitrary "uid" is accessible by users listed in its branches under the "exampleUserEntityObject" attribute of entries with "exampleSSOAccountDelegation" objectClass.

Ciao, p.

   SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497