Re: regex in group ACL

[Pierangelo Masarati <ando@sys-net.it>]

François,

I (finally) understood your problem (at least I think), and my answer is 
that currently there's no means to do that even with sets (which are not 
as magic as I thought, although very versatile).  As such, I just 
extended them in HEAD code to allow subsearches when resolving DNs by 
means of the URI form.  If you have a chance to try HEAD code, the 
following (yet undocumented) access rule sshould do the trick (just 
tested with a similar setup of yours):

access to 
dn.regex=".*,(cn=exampleSSOStorageV2,uid=[^,]+,ou=Users,dc=example,dc=com)$"
       by 
set.expand="[ldap:///$1??subtree?(objectClass=exampleSSOAccountDelegation)]/exampleUserEntityObject 
& user" read

which means: everything below 
"cn=exampleSSOStorageV2,uid=[^,]+,ou=Users,dc=example,dc=com"
with arboitrary "uid" is accessible by users listed in its branches 
under the "exampleUserEntityObject" attribute of entries with 
"exampleSSOAccountDelegation" objectClass.

Ciao, p.





   SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497