[Date Prev][Date Next]
question regarding ACLs
- To: <firstname.lastname@example.org>
- Subject: question regarding ACLs
- From: "Kick, Claus" <email@example.com>
- Date: Mon, 6 Oct 2008 16:09:26 +0200
- Content-class: urn:content-classes:message
- Thread-index: AcknvSRjIoATZvNaRDanqcO0DFB3CA==
- Thread-topic: question regarding ACLs
Since there is some time, I figured I rectify our openldap configuration
and use proper ACLs.
We are using the following version on Solaris 10:
[xxxx:/opt/csw/libexec]$ ./slapd -V
@(#) $OpenLDAP: slapd 2.3.39 (Feb 22 2008 18:51:52) $
Our user subtree is organized as shown below:
Basically, I want a getent passwd not to list entries below
ou=removed_accounts,ou=people,o=suffix, for a client application still
considers the removed accounts as users (it probably searches the whole
I read the documentation for 2.3:
And found this:
The scope can be either base, one, subtree, or children. Where base
matches only the entry with provided DN, one matches the entries whose
parent is the provided DN, subtree matches all entries in the subtree
whose root is the provided DN, and children matches all entries under
the DN (but not the entry named by the DN).
So, I figured that an ACL (no global ACLs any longer) like this
access to dn.one="ou=People,o=suffix" by * write
Should hide the removed accounts and only show the active ones.
But it does not, it still contains all the children of
Using dn.base="ou=People,o=suffix" by * write
Works as expected and getent passwd not return any ldap users, solely
the /etc/passwd users.
The client system in question is a Solaris 10 machine, I have kept the
client configuration unchanged for the tests so far:
There are only two other ACLs in place:
1. access to dn.one="ou=Group,o=siemensmedical.com" by * write
This one works fine, getent group returns all the groups it should
return and the changes can be done as well.
2. access to dn.subtree="ou=Roles,o=siemensmedical.com" by * write
This one works fine as well, it returns the role structure as requested
and changes work as well.
Where am I making a mistake?