|
Hi everyone! For compatibility reasons I had to change the way I store my user's password in LDAP from SSHA to plaintext and now I want to try to restrict the access to some attributes while I find a better solution. My ldap tree is something like this: dc=domain,dc=com cn=freeradius cn=diradmin cn=readonly cn=user1 o=company1 cn=admins_company1 (member: uid=user1 and uid=user6) ou=users uid=user1 uid=user2 ou=groups cn=company1_group1 cn=company1_group2 o=company2 cn=admins_company2 ou=users uid=user3 uid=user4 ou=groups cn=company2_group1 cn=company2_group2 o=company3 cn=admins_company3 ou=users uid=user5 uid=user6 ou=groups cn=company2_group1 cn=company2_group2 o=user1subtree ou=users uid=user15 uid=user62 ou=groups cn=group1 cn=group2 HERE THE PERMISSION I WANT TO GRANT all the users can modify their own attributes user cn=freeradius is used by freeradius to auth the users on the 802.11x wi-fi. It should read all the tree including the userPassword attribute user cn=diradmin is the rootdn cn=readonly can read the whole tree but not the userPassword attribute cn=user1 can read the whole directory (not the userPassword attribute) and write in his own subtree (o=user1subtree) uid=user1 and uid=user6 are company1's administrators, so they can write in whole o=company1 subtree the number of companies changes often and so I can't statically define an ACL for accessing a subtree I wrote the following ACL (but is the first time) are them correct or I'm missing something? The regex is expensive (any search in the tree takes a lot of time) but works, how can I optimize it? {0}to attrs=userPassword by self =xw by dn="cn=freeradius,dc=domain,dc=com" read by anonymous auth by * none {1}to attrs=shadowLastChange by self write by * read {2}to dn.subtree="o=user1subtree,dc=domain,dc=com" by dn="cn=user1,dc=domain,dc=com" write {3}to dn.regex="o=(.+),dc=domain,dc=com$" by group.expand="cn=admins_$1,o=$1,dc=domain,dc=com" write by dn="cn=user1,dc=domain,dc=com" read by dn="cn=freeradius,dc=domain,dc=com" read by self write {4}to * by dn="cn=user1,dc=domain,dc=com" read by dn="cn=freeradius,dc=domain,dc=com" read by * read by self write by anonymous auth Thanks! -- Alberto Aldrigo |