[Date Prev][Date Next] [Chronological] [Thread] [Top]

acl sets don't appear to work

I'm running OpenLDAP 2.1.30 on a Gentoo linux system. I've been running

this with samba 3.0.14a very successfully for over a year. When I set this system up, I followed the howto presented by idealx.org, and I've been pretty happy with the results.

But, recently, I decided that logging in as root and/or cn=Manager to do maintenance on the DIT was not a very good idea. I figured, having a "Domain Admins" group defined in my ldap directory should provide me with an excellent control for who can/cannot edit the DIT...

regretfully, the memberUID attribute only stores the shortname for users, so this has complicated setting up acl's for superuser access to the directory.
I discovered acl sets. But, I can't seem to get them working.

I've followed the examples in the Faq-O-Matic
"Sets in Access Controls" (http://www.openldap.org/faq/index.cgi?_highlightWords=sets%20in%20access%20controls&file=1133)

"Sets as 'reverse groups' (http://www.openldap.org/faq/index.cgi?_highlightWords=reverse%20groups&file=1134)

I even went so far as to insert an extremely basic acl at the beginning of the acl list
access to dn="uid=testuser,ou=Users,dc=example,dc=com"
by set.exact="user/uid & [adminuser]" write
by * read

when I attempt to edit an attribute of this user, I get ...
Jan 19 19:31:20 [slapd] => acl_mask: access to entry "uid=testuser,ou=Users,dc=example,dc=com", attr "description" requested_
Jan 19 19:31:20 [slapd] => acl_mask: to all values by "uid=adminuser,ou=users,dc=example,dc=com", (=n) _
Jan 19 19:31:20 [slapd] <= check a_dn_pat: *_
Jan 19 19:31:20 [slapd] <= acl_mask: [2] applying read(=rscx) (stop)_
Jan 19 19:31:20 [slapd] <= acl_mask: [2] mask: read(=rscx)_
Jan 19 19:31:20 [slapd] => access_allowed: write access denied by read(=rscx)_

this is obviously a less complex acl than I will need to allow all users listed in the memberUid attribute of the posixAccount, but if I can't make this work, I'll never make the real acl work. Am I configuring it wrong, or is there a config option that I missed during compilation?