Re: Readable but not searchable?

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Daniel Henninger writes:
> =r access, then I was never able to find anything.  Maybe I was searching
> incorrectly?  If you had your access rule set up like this, and went to
> use ldapsearch, what would you enter?

Sorry, I should have mentioned that.

ldapseach -b 'printer-name=foo,ou=private,ou=printers,dc=ncsu,dc=edu' \
          -s base "(&)"

"(&)" is the True filter - it matches anything.

> I tried something like:
> ldapsearch -b 'ou=private,ou=printers,dc=ncsu,dc=edu' '(printer-name=foo)'
> but had no luck

Because you did search for printer-name, which is disabled by the
access controls.

The access controls I mentioned should even prohibit "(objectClass=*)".
If your clients use that as the 'anything' filter, you need something like

  access to dn.subtree=ou=private,ou=printers,dc=ncsu,dc=edu
            attrs=objectClass by * =rcs

before the other access statement.

>>   access to dn.subtree=ou=private,ou=printers,dc=ncsu,dc=edu by * =r

-- 
Hallvard