Re: Re: what is wrong with my permissions?

[Igor Shmukler <igor.shmukler@gmail.com>]

Hello Ulrich,

Thank you.
I finally figured out my problem. I did not notice/realize that
permissions were being given in stages: userPassword, dn.base then *.
Once I added dn="cn=config" to the correct line, things started
working.
I appreciate your help. [This is already, at least, the second time.]

Sincerely,

Igor Shmukler


On Mon, Mar 23, 2015 at 4:43 PM, Ulrich Windl
<Ulrich.Windl@rz.uni-regensburg.de> wrote:
>>>> Igor Shmukler <igor.shmukler@gmail.com> schrieb am 19.03.2015 um 15:03 in
> Nachricht
> <CAA1SNA1h-FRxM=+MHqnTVncZscj-CS5avHbT4NvqcRMnh+_zMA@mail.gmail.com>:
>> Hi Ferenc,
>>
>> I am still getting the same error with both by and your versions. Please
>> advise:
>>
>> $ cat set_config_passwd.ldif
>> dn: olcDatabase={0}config,cn=config
>> changetype: modify
>> replace: olcAccess
>> olcAccess: {0}to * by
>> dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
>>  ,cn=auth manage by * break
>> olcAccess: {1}to * by dn.exact=cn=config
>>
>> $ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f set_config_passwd.ldif
>> SASL/EXTERNAL authentication started
>> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
>> SASL SSF: 0
>> modifying entry "olcDatabase={0}config,cn=config"
>
> Igor,
>
> you allow cn=config to manage the config database, but below you remove an entry from another database with cn=config credentials.
>
>>
>> $ ldapdelete -x -D cn=config -W cn=john,dc=directory,dc=com
>> ldap_delete: Insufficient access (50)
>>   additional info: no write access to parent
>>
>> I even tried stripping the first line, so the rule was: {0}to * by
>> dn.exact=cn=config
>> Still gives me the same error.
>
> Check the ACL in the other database!
>
>>
>> Please advise,
>>
>> Igor Shmukler
>>
>>
>> On Thu, Mar 19, 2015 at 2:54 PM, Ferenc Wagner <wferi@niif.hu> wrote:
>>> Igor Shmukler <igor.shmukler@gmail.com> writes:
>>>
>>>> I want it to be something like:
>>>> olcAccess: {1}to * by dn="cn=config" manage
>>>>
>>>> Basically, I want dn=cn=config to have full root access over
>>>> everything. I also want this password ideally to be password
>>>> protected.
>>>>
>>>> Does it make sense? Can it be done?
>>>
>>> Sure.  Add this olcAccess attribute to all the databases.  Or to the
>>> frontend database, but check man slapd.access for the priorities and
>>> defaults.  For what it's worth, I use the syntax
>>>
>>> to * by dn.exact=cn=config
>>>
>>> (which should be equivalent to yours).
>>> --
>>> Feri.
>
>
>
>