[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Challenge With Access Control

On 05/07/07, Brian Gaber <Brian.Gaber@pwgsc.gc.ca> wrote: 



Hope someone can explain this to me.  I am sure it is very trivial.  I have
a primary LDAP server (10.16.13.84), a replica LDAP server (10.16.13.85) and
a few clients all with a 10.16.13.x address.

Here is the access control I thought would work:

access  to *
  by self write
  by peername=10.16.13.84 write
  by peername=10.16.13.81 read
  by peername=10.16.13.82 read
  by peername=10.16.13.83 read
  by peername=10.16.13.85 read
  by peername=10.16.13.86 read

Here is what does work:

access to *
  by self write
  by peername.ip=10.16.13.84 write
  by * read

        By work I mean that when I am on the replica (10.16.13.85) and issue
an ldapsearch to itself I get a 32 no such object with the top access, but I
get the expected result with the bottom access.


I am not 100% sure, but maybe this will help you (I am using similar
ACL). AFAIR in the peername you need to add the "IP=" - but I don't
really remember, please correct me. The regex matching directive that
works for me looks like this:

by peername.regex="IP=10\.10\.120\..+" read

Then you could try:

by peername.regex="IP=10\.16\.13\.8[1-6]" read

And please double check if you need to supply the "IP=10.10.10.10" for
the "by peername" without regex.
The regex solution will not conflict with the first entry as write
permission includes reading (and ACL parsing stops on the first
matched rule).

Hope this helps.

Regards,
Michal


Brian Gaber