Re: ACL and ACI define problem

[Karen R McArthur <kmcarthu@bates.edu>]

Have you considered setting up a groupOfNames for each section admin group?

dn: ou=sectionAuth,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: sectionAuth

dn: cn=section1Admins,ou=sectionAuth,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: section1Admins
member: uid=user1,ou=People,dc=example,dc=com
member: uid=user2,ou=People,dc=example,dc=com
member: uid=user3,ou=People,dc=example,dc=com

And then

access to * filter=(sectionField=section1)
   by group.exact="cn=section1Admins,dc=example,dc=com" write


Carlos Lozano wrote:

> Hello,
>                                                                                
> I am having problems to define a ACL or ACI, my tree looks like:
>                                                                                
> * cn=user1,ou=users, ...
>  sectionfield=section1
>  adminfield=
>                                                                                
> * cn=user2,ou=users, ...
>  sectionfield=section1
>  adminfield=section1
>                                                                                
> I need a ACL, what does possible:
>                                                                                
> if (userA.adminfield == userB.sectionfield) {
>   userA will have write permission about userB info.
> }
>                                                                                
> Is it possible?
>                                                                                
> Very thanks,
> Regards,
> Carlos.
>
>