[Date Prev][Date Next]
Re: ACL questsion about 'by group'
> I am sure I'm not understanding this right. What I would like to do is
> access based on membership in a posixGroup entry. I am not seeming to get
> the syntax right. I've tried doing:
> access to <resource>
> by group="cn=PosixGroup,dc=mycompany,dc=com" write
> That group contains three memberUID entries. The ACL is not working
> I read slapd.access carefully and even tried:
> by group/posixGroup/memberUID="cn=PosixGroup,dc=mycompany,dc=com" write
> But that one doesn't work either. I'm thinking I am probably not
> understanding some of the conventions used in the man page. Any help
> be great!
The syntax "by group/posixGroup/memberUID" is correct, but the
AttributeDescription "memberUID" does not resolve to a distinguishedName
or nameAndOptionalUID valued attribute, rather to a POSIX group id. I
don't see an immediate workaround. Simply, posixGroup memberUIDs are not
fine for LDAP access control.
SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497