[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: slapd.access dn.regex sasl
In this case, I think you should rather read slapd.conf(5) man page, and
the Admin Guide; the statement below
> access to dn.regex=".*$"
> #access to dn.subtree="ou=Utiba,ou=People,dc=utiba"
> attrs=sambaLMPassword,sambaNTPassword,userPassword,sambaPasswordHistory,sambaPwdLastSet,uid,objectClass
> by self write
> by dn.exact,expand="uid=root,ou=System,ou=People,dc=utiba" write
> by dn.exact,expand="uid=admin,ou=System,ou=People,dc=utiba" auth
> by group.expand="cn=Domain Controllers,ou=Group,dc=utiba" write
> by group.expand="cn=Replicator,ou=Group,dc=utiba" write
> by * auth
actually expands in:
<statement 1>
access to dn.regex=".*$"
</statement 1>
<statement 2>
#access to dn.subtree="ou=Utiba,ou=People,dc=utiba"
attrs=sambaLMPassword,sambaNTPassword,userPassword,sambaPasswordHistory,sambaPwdLastSet,uid,objectClass
by self write
by dn.exact,expand="uid=root,ou=System,ou=People,dc=utiba" write
by dn.exact,expand="uid=admin,ou=System,ou=People,dc=utiba" auth
by group.expand="cn=Domain Controllers,ou=Group,dc=utiba" write
by group.expand="cn=Replicator,ou=Group,dc=utiba" write
by * auth
</statement 2>
where statement 2 is a comment continued on multiple lines by the leading
spaces (I assume the "attrs=..." does not start in column 1, but got there
because the mailer wrapped a long line).
So statement 1 is an empty rule. That's why you get that "no more <who>
clauses" besides the implicit "by * none":
>> >when it fails
>> >------------------------------------
>> >access_allowed: auth access to "uid=dennis,ou=Utiba,ou=People,dc=utiba"
>> >"uid" requested
>> >May 6 11:28:41 blackops slapd[30775]: => dn: [1]
>> >May 6 11:28:41 blackops slapd[30775]: => dn: [2] cn=subschema
>> >May 6 11:28:41 blackops slapd[30775]: => dnpat: [3] ^.+$ nsub: 0
>> >May 6 11:28:41 blackops slapd[30775]: => acl_get: [3] matched
>> >May 6 11:28:41 blackops slapd[30775]: => acl_get: [3] attr uid
>> >May 6 11:28:41 blackops slapd[30775]: => acl_mask: access to entry
>> >"uid=dennis,ou=Utiba,ou=People,dc=utiba", attr "uid" requested
>> >May 6 11:28:41 blackops slapd[30775]: => acl_mask: to value by "",
>> (=n)
>> >May 6 11:28:41 blackops slapd[30775]: <= acl_mask: no more <who>
>> >clauses, returning =n (stop)
The rationale is that you cannot embed a comment inside a statement.
p.
--
Pierangelo Masarati
mailto:pierangelo.masarati@sys-net.it
SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497