[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: ACL for PGP [Virus checked (@MLP)] [Virus checked]
Hi again!
I'm still a little bit confused, with this structure:
access to dn=".*,o=PGP Keys,dc=atrete,dc=ch"
by * write
access to dn=".*,dc=atrete,dc=ch" by * write
access to dn=".*,dc=ch" by * read
access to * by * write
you mean that any other ldap client wont have write permission to
everything? Sorry, but I'm a little bit puzzle. And what if I just wanted
a certain user to do this update of the PGP clients, how would that look
like? Thanks again!
Regards,
Alejandra
At 16:21 08.01.2002 +0100, you wrote:
Hi!
You are right, I looks terribly, and I do not recommend to build acls
like this,
but OpenLDAP-ACLs are being processed from top to down, and the
first
acl that matches is been used. So I only give write permission to
everyone
(including anonymous) to everything except
access to dn=".*,dc=ch" by *
read
Here is only read permission given.
Please correct me, if i should be wrong.
Joachim
Alejandra Moreno <alejandra.moreno@atrete.ch> am 08.01.2002
09:53:15
An: Joachim Koch/Login/DE/MLP@MLP
Kopie: openldap-software@OpenLDAP.org
Thema: Re: ACL for PGP - WAS:Re: Storing Special German
Characters in
OpenLDAP as PGP -Directory [Virus
checked (@MLP)] [Virus checked]
Hi!
But with the last line aren't you giving permission to everybody to
write
on the whole tree???? I wouldn't like that!
You are right, NAI's integration seems really poor!
Alejandra
At 17:32 04.01.2002 +0100, you wrote:
>Hi!
>
>This works:
> access to
dn=".*,o=PGP Keys,dc=atrete,dc=ch" by * write
> access to
dn=".*,dc=atrete,dc=ch" by * write
> access to dn=".*,dc=ch" by *
read
> access to * by * write
>
>The first lines gives write permission to everything _below_
"o=PGP
>Keys,dc=atrete,dc=ch",
>but why tries PGP to write on level "*,dc=atrete,dc=ch"
?
>
>The ldap integration for PGP by NAI seems to be poorly programmed.
:-(
>
>Joachim
>
>
>
>
>
>Alejandra Moreno <alejandra.moreno@atrete.ch> am 04.01.2002
17:13:02
>
>
>An: Joachim Koch/Login/DE/MLP@MLP,
openldap-software@OpenLDAP.org
>Kopie:
>
>Thema: Re: ACL for PGP - WAS:Re: Storing Special
German Characters in
> OpenLDAP as PGP -Directory
[Virus checked (@MLP)] [Virus checked]
>
>
>
>Hi!
>
>If you try :
>
>access to dn=".*,o=PGP Keys,dc=atrete,dc=ch" by *
write
>access to dn=".*,dc=ch" by * read
>access to * by * read
>
>to send a key you get the error: no write access to parent
>But don't I give write access to parent with the first line? This is
crazy!!!
>
>Alejandra
>
>
>At 16:56 04.01.2002 +0100, you wrote:
> >Hi!
> >
> >try this, if you only want to search for keys:
> >access to dn=".*,o=PGP Keys,dc=atrete,dc=ch" by *
write
> >access to dn=".*,dc=ch" by * read
> >---> access to * by * read <----
> >
> >
> >The third line has to be
> > access to * by * write !!!
> >if you want to send keys to the server.
> >
> >I'm wondering why the third line is neccesary. What does the
##$#-Client
> >try and
> >where?
> >
> >Greets,
> >Joachim
> >
> >
> >
> >
> >
> >Alejandra Moreno <alejandra.moreno@atrete.ch> am
04.01.2002 16:12:39
> >
> >
> >An: openldap-software@OpenLDAP.org
> >Kopie: (Blindkopie: Joachim
Koch/Login/DE/MLP)
> >
> >Thema: Re: Storing Special German Characters
in OpenLDAP as
> >PGP -Directory
> > [Virus checked
(@MLP)] [Virus checked]
> >
> >
> >
> >Hi!
> >
> >I also tried that, and still didn't work. It's driving me
nuts!!!!
> >
> >At 15:35 04.01.2002 +0100, you wrote:
> > >quote Alejandra Moreno (4.1.2002):
> > >
> > > > If you get some feed back from NAI, just tell
me!
> > > > You were write about the access permission, the
following syntax wont
> > work:
> > > >
> > > > access to dn=".*,dc=ch" by * read
> > > > access to dn=".*,o=PGP
Keys,dc=atrete,dc=ch" by * write
> > >
> > >switch the ACLs to:
> > >access to dn=".*,o=PGP Keys,dc=atrete,dc=ch" by *
write
> > >access to dn=".*,dc=ch" by * read
> > >
> > >the first matching ACL makes the job.
> > >
> > >
> > > Sebastian Dietzold
> > >
> > >--
> > >Sebastian Dietzold
> > >Content Management / Directory Services
> > >Institute for Medical Informatics,
> > >Statistics and Epidemiology (IMISE)
> > >University of Leipzig
> > >Liebigstr. 27
> > >04103 Leipzig
> > >Phone: +49 341 97 161 14
> > >Fax: +49 341 97 161 30
> >
>
>______________________________________________________________________
> >Alejandra Moreno Espinar
> >at rete ag
> >
>
>mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
> >snail mail: Oberdorfstrasse 2, P.O. Box 674, 8024 Zurich,
Switzerland
> >voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266
55 88
>
>_____________________________________________________________________
> >
> >
>
>______________________________________________________________________
> >Alejandra Moreno Espinar
> >at rete ag
> >
>
>mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
> >snail mail: Oberdorfstrasse 2, P.O. Box 674, 8024 Zurich,
Switzerland
> >voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266
55 88
>
>_____________________________________________________________________
>
>______________________________________________________________________
>Alejandra Moreno Espinar
>at rete ag
>
>mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
>snail mail: Oberdorfstrasse 2, P.O. Box 674, 8024 Zurich,
Switzerland
>voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266 55
88
>_____________________________________________________________________
______________________________________________________________________
Alejandra Moreno Espinar
at rete ag
mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
snail mail: Oberdorfstrasse 2, P.O. Box 674, 8024 Zurich,
Switzerland
voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266 55
88
_____________________________________________________________________
______________________________________________________________________
Alejandra Moreno Espinar
at rete ag
mailto:alejandra.moreno@atrete.ch,
http://www.atrete.ch
snail mail: Oberdorfstrasse 2,
P.O. Box 674, 8024 Zurich, Switzerland
voice: +41-1-266 55 55, direct: +41-1-266 55 91, fax: +41-1-266 55 88
_____________________________________________________________________