[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ACL Assistance

I think you misspelled "attrs". You used "attr".

On May 15, 2007, at 8:33 AM, Joshua M. Miller wrote:

I'm running OpenLDAP 2.3.34 and am having trouble figuring out the ACLs. I have the following:

access  to attr=userPassword
        by self         write
        by anonymous    auth
        by *            none
access  to *
        by self         write
        by *            read

My intention is to allow everything but the userPassword attribute to be available to all users and have the userPassword attribute be available for authentication and password changes by each user (but only for each user).

The problem with the above ACL is that I am able to read all user's password hashes through an authenticated bind. What am I doing wrong?

Joshua M. Miller - RHCE,VCP

Attachment: smime.p7s
Description: S/MIME cryptographic signature