Re: ACL for object creation in subtree with specific attributes and object classes

[Simeon Ott <simeon.ott@onnet.ch>]

On 05.08.2014, at 15:00, Dieter Klünter <dieter@dkluenter.de> wrote:

> Am Tue, 5 Aug 2014 13:39:13 +0200
> schrieb Simeon Ott <simeon.ott@onnet.ch>:
> 
>> On 05.08.2014, at 11:39, Dieter Klünter <dieter@dkluenter.de> wrote:
>> 
>>> Am Tue, 5 Aug 2014 09:41:36 +0200
>>> schrieb Simeon Ott <simeon.ott@onnet.ch>:
>>> 
>>>> […]
>>>> 	by
>>>> dn.base,expand="cn=postmaster,ou=$2,ou=domains,dc=mydomain" write
>>>> by
>>>> * read access to * 
>>>> 	by dn.base="cn=admin,dc=mydomain" write
>>>> 	by * read
>>>> 
>>>> ACL rule 4 allows the postmaster to add objects to it's "domain"
>>>> without any restrictions. How can i restrict the object creation to
>>>> specific object classes and attributes? Let's say postmaster should
>>>> only be able to add objects like the following:
>>> [...]
>>> man slapd.access(5), the <WHAT> field: @<objectClass>
>>> 
>>> -Dieter
>>> 
>> 
>> Thanks Dieter, I tried the following already … instead of rule 3 and
>> 4 i used the following:
>> 
>> access to
>> dn.regex="^(.+,)?ou=(.+),ou=domains,dc=intra,dc=onnet,dc=ch$"
>> attrs=@CourierMailAccount,@inetOrgPerson,@top,@Vacation,entry,vacationInfo,smtpRelayFlag,description,vacationForward,displayName,givenName,homePhone,homePostalAddress,initials,mobile,postalAddress,postalCode,l,telephoneNumber,title
>> by self write by
>> dn.base,expand="cn=postmaster,ou=$2,ou=domains,dc=intra,dc=onnet,dc=ch"
>> write by * read
>> 
>> access to dn.regex="^ou=(.+),ou=domains,dc=intra,dc=onnet,dc=ch$"
>> attrs=children by
>> dn.base,expand="cn=postmaster,ou=$1,ou=domains,dc=intra,dc=onnet,dc=ch"
>> write by * read
>> 
>> As postmaster I'm still able to add objects to it's domain. But I'm
>> also able to add other objectclasses and attributes.
>> 
>> I think I mess around with the attributes entry and children  –
>> anyone help me cleaning up? :-)
> 
> run slapd in debugging mode acl and watch the rule number applied to a
> write operation.
> 

Okay, this didn't really help, but thanks anyway. I'm not familiar with reading those logs. i adjusted the loglevel to 128 to see the acl processing. but it's still a huge amount of log lines when adding such an ldif. i thought it's gonna be an easy task.