[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
RE: About ACL
> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Pierangelo
> Masarati
> ludovico.basili@poste.it writes:
>
> > Hello,
> > I have already wroten a message, but I think I couldn't
> > explain my problem clearly.
> > I would like to define an ACL that permits to a user
> > defined in a position in the tree to read only a subtree
> > whose root position depends on the position of the user.
> > For example, if the user is
> > cn=foo,ou=People,o=XYZ
> > he can read everywhere under
> > ou=People,o=XYZ
> > If the user is
> > cn=me,ou=Something,ou=People,o=XYZ
> > he can read everywhere under
> > ou=Something,ou=People,o=XYZ
> > The users are added/removed by my application at runtime,
> > so I would like to have the privileges been assigned to new
> > users without restarting slapd. Is it possible ?
> >
>
> try something like
>
> access to dn=".+,ou=([^,]+),ou=People,o=XYZ"
> by dn="cn=[^,]+,ou=$1,ou=People,o=XYZ" read
In the original example there are users at multiple depths in the ou=
hierarchy. To get all that in a single rule, try this:
access to dn=".+,ou=(.+),o=XYZ"
by dn="cn=[^,]+,ou=$1,o=XYZ
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
http://www.symas.com http://highlandsun.com/hyc
Symas: Premier OpenSource Development and Support
- References:
- Re: About ACL
- From: "Pierangelo Masarati" <masarati@aero.polimi.it>