[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Question to meta-backend / ldap-backend



Wilhelm Meier <wilhelm.meier@fh-kl.de> writes:

> Am Montag 27 Oktober 2008 schrieb Pierangelo Masarati:
>> Wilhelm Meier wrote:
>> > I don't see how to make this work with the rwm-overlay or some
>> > sort of acls.
>> > But I'm sure, I missed something ...
>>
>> You probably didn't read slapd.access(5) where it discusses the
>> "filter" form of the <what> clause.
>
> Thank you for this advice, but it doesn't fully solve the problem:
>
> access to attrs=userPassword,shadowLastChange
>         dn.regex="uid=([^,]+),ou=Benutzer,dc=kmux,dc=de"
>         filter="gidNumber=998"
>         by dn="cn=admin,dc=kmux,dc=de" write
>         by anonymous auth
>         by self write
>         by * none
>
> This limits the authentication to users whose posix primary (!) group 
> hat the gid-number 998 (the dn.regex in the example above isn't 
> needed).
>
> But that's not the whole story. We want to grant access also to those 
> users with one of their secondary (!) posix groups is some special 
> group, e.g. cn=archiv,ou=gruppen,dc=kmux.dc=de
>
> So it must be possible to search for an object of 
> objectclass=posixGroup with the attribute memberUid=<uid>, where 
> <uid> is the value of the uid-attribute of the user, who tries to 
> bind to the slapd. If this search returns one (or more) results, the 
> user should be authenticated.

This approach can be solved by sets. 
http://www.openldap.org/faq/data/cache/1133.htm
An search the mail archive, there can be found numerous examples.

-Dieter

-- 
Dieter KlÃnter | Systemberatung
sip: +49.180.1555.7770535
http://www.dpunkt.de/buecher/2104.html
GPG Key ID:8EF7B6C6