Re: acl confusion in proxy server config

[masarati@aero.polimi.it]

> I have a proxy server ('ldap' backend) sitting in front of a master
> directory.
>
> The DNs on my master directory are UUIDs + ou + domain, e.g.
> myid=1234...89,dc=yada,dc=com.
>
> Each object has a (unique) username attrbute.
>
> Logging in on the proxy server involves mapping the username to the DN
>
> rwm-rewriteMap ldap uid2DN
> "ldaps://server.somewhere.com/ou=something,dc=xyz,dc=com?dn?sub"
> binddn="uid=..." credentials="xxx"
>
> rwm-rewriteContext  bindDN
> rwm-rewriteRule     "^uid=([a-z0-9_]{3,24}),ou=zzz"
>                     "${uid2DN(myusername=$1)}"
>                     ":@I"
>
> I would like anyone logging in as themselves to be able to read their
> own attributes.  I'm having trouble doing this.  'Self' doesn't seem to
> work because of the mapping going on, e.g.
>
> access to dn.sub="ou=vpn"
>        by self read
>        by anonymous auth
>        by * non
>
> Aug 11 11:22:09 mid slapd[5848]: => acl_mask: access to entry
> "myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=zzz", attr "entry" requested
> Aug 11 11:22:09 mid slapd[5848]: => acl_mask: to all values by
> "myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=something,dc=xyz,dc=com",
> (read(=rscxd))
> Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: self
> Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: anonymous
> Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: *
> Aug 11 11:22:09 mid slapd[5848]: <= acl_mask: [3] applying none(=0) (stop)
> Aug 11 11:22:09 mid slapd[5848]: <= acl_mask: [3] mask: none(=0)
> Aug 11 11:22:09 mid slapd[5848]: => slap_access_allowed: read access
> denied by none(=0
>
> I think 'self' doesn't match because
> myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=zzz does not equal
> myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=something,dc=xyz,dc=com
> (is my thinking correct on this?)
>
> How do I allow a user to read their own attributes in this situation?

If I get you correctly, you bind as

  myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=zzz (1)

and you want it rewritten as

  myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=something,dc=xyz,dc=com (2)

but then you would like slapd to recognize (2) as "self" of (1); one thing
you could probably do is use authz-regexp (see slapd.conf(5)) to authorize
(2) as (1) again (although I think this is getting too much wound up to
make any sense).  At this point, the identity would appear as (1) for
"self", and as (2) for "realself".  I haven't checked, so I can't
guarantee it works.

p.