[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: help with ACL

To: Quanah Gibson-Mount <quanah@symas.com>, openldap-technical@openldap.org
Subject: Re: help with ACL
From: Alberto Aldrigo <alberto.aldrigo@h-farm.com>
Date: Wed, 4 Jan 2017 14:44:54 +0100
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=h-farm.com; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=zvmmyNjPdBOMo1Zkh1Fyo8ekYe9pAMGjiF+M/3yeMxg=; b=jo14yuCDcuk5pfGrRpEpy8N1zGuRuEEqdhruoDhFRY8cHwGWLxrJnrI+Bpo8geD14q NJDh6xGwTksX1YzDlCKZTCUrJi+uqhlntWikjHF+i6sz25plx3BARwiER1cNaT0XA7Mh jdRSe1Ivz4YHL8/7B88vBC48ErJX0jdcMuguo=
In-reply-to: <EF365D39EDCA14CA604DD2DD@[192.168.1.30]>
References: <adcf6cbc-38fe-695a-5d78-afa05713d809@h-farm.com> <WM!da077f5557c42edd6609a6f7b10963a8f189269b0cf55413d47be155c94a3caa5ce8becfde23e45772864dc62d721a16!@mailstronghold-1.zmailcloud.com> <EF365D39EDCA14CA604DD2DD@[192.168.1.30]>
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.5.1

So an ACL could be:

to dn.subtree="o=company1,dc=domain,dc=com" by group="c cn=admins_company1,o=company1,dc=domain,dc=com" write

I have 25 of these groups, so I need 25 ACLs like the one above: having one per line can lead to a performance issue?

thanks

Alberto Aldrigo

Il 28/12/16 19:22, Quanah Gibson-Mount ha scritto:

--On Friday, December 23, 2016 11:16 AM +0100 Alberto Aldrigo <alberto.aldrigo@h-farm.com> wrote:

uid=user1 and uid=user6 are company1's administrators, so they can write
in whole o=company1 subtree

Might be best to make an LDAP group with those users as members, and then write an ACL based off of that group for its specific privileges.

--Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>

H-FARM Spa

Tenuta Ca' Tron

via Sile, 41 – Roncade

Treviso IT – 31056

T +39 0422 7896

S h-farm.com

Prev by Date: Syncrepl and multipe values
Next by Date: (host) and (uid) not indexed (after creating an account)
Index(es):
- Chronological
- Thread