Re: Letting Users Create Groups

[Tim Gustafson <tjg@soe.ucsc.edu>]

> to prevent gidNumber duplicates you probably need slapo-unique.

That works well; here's my configuration:

overlay unique
unique_uri ldap:///ou=Group,dc=example?cn?sub?
unique_uri ldap:///ou=Group,dc=example?gidNumber?sub?

> ACLs along these lines should do the rest:
> 
> access to dn.exact="ou=group,dc=example" attrs=children
> by users write
> 
> access to dn.sub="ou=group,dc=example" attrs=entry
> filter="(&(objectClass=posixAccount)(gidNumber>=1000)(gidNumber<=1000)"
> by users add

I already have this:

access to
 dn.subtree="ou=Group,dc=example"
 attrs=manager,memberUid,description,myStatus,myComment
 by set="this/manager & user" write
 by * break

(My groups all have an additional objectClass, myGroup, which adds a manager, description, myStatus and myComment attribute to groups.)

Will the ACLs you propose break that?  It doesn't look like they will; I just want to make sure.

Tim Gustafson
Baskin School of Engineering
UC Santa Cruz
tjg@soe.ucsc.edu
831-459-5354