my DIT is some like this:
dc=<base>
|__ dc=<domain_1>
| |__ o=<org_1>
| | |__cn=user_domain1_1
| | |__cn=user_domain1_2
| | |__cn=user_domain1_3
| |__ o=<org_2>
| |__cn=user_domain1_3
| |__cn=user_domain1_4
| |__cn=user_domain1_5
|__ dc=<domain_2>
|__ o=<org_3>
| |__cn=user_domain2_1
| |__cn=user_domain2_2
| |__cn=user_domain2_3
|__ o=<org_4>
|__cn=user_domain2_3
|__cn=user_domain2_4
|__cn=user_domain2_5
I would like to create one administrative account for each domain (<domain_1> and <domain_2>)
Here is my way:
I create a new branch:
dc=<base>
|__ o=Administrators
|__ou=<domain_1>_Administrators
|__ cn=Administrator1
then I insert a new directive in slapd.conf
access to dn.subtree="dc=<domain_1>,dc=<base>" by dn="cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>" write
Here the response when I try to connect with <domain_1>Administrators credentials:
Error opening connection:
[LDAP: error code 49 - Invalid Credentials]
Here the OpenLDAP's output in debug mode
daemon: activity on 1 descriptor
daemon: activity on:
slap_listener_activate(7):
daemon: epoll: listen=7 busy
>>> slap_listener(ldap://<my_host>:1389)
daemon: activity on 1 descriptor
daemon: activity on:
daemon: epoll: listen=7 active_threads=0 tvp=NULL
daemon: listen=7, new connection on 11
daemon: added 11r (active) listener=(nil)
daemon: activity on 1 descriptor
daemon: activity on:
daemon: epoll: listen=7 active_threads=0 tvp=NULL
daemon: activity on 1 descriptor
daemon: activity on: 11r
daemon: read active on 11
daemon: epoll: listen=7 active_threads=0 tvp=NULL
connection_get(11): got connid=1000
connection_read(11): checking for input on id=1000
ber_get_next
ber_get_next: tag 0x30 len 83 contents:
op tag 0x60, time 1268990296
ber_get_next
daemon: activity on 1 descriptor
daemon: activity on:
daemon: epoll: listen=7 active_threads=0 tvp=NULL
conn=1000 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_scanf fmt (m}) ber:
>>> dnPrettyNormal: <cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>>
<<< dnPrettyNormal: <cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>>, <cn=administrator1,ou=<domain_1>dministrators,o=administrators,dc=<base>>
do_bind: version=3 dn="cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>" method=128
bdb_dn2entry("cn=administrator1,ou=<domain_1>administrators,o=administrators,dc=<base>")
=> bdb_dn2id("dc=<base>")
<= bdb_dn2id: got id=0x1
=> bdb_dn2id("o=administrators,dc=<base>")
<= bdb_dn2id: got id=0x12
=> bdb_dn2id("ou=<domain_1>administrators,o=administrators,dc=<base>")
<= bdb_dn2id: got id=0x13
=> bdb_dn2id("cn=administrator1,ou=<domain_1>administrators,o=administrators,dc=<base>")
<= bdb_dn2id: got id=0x14
entry_decode: "cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>"
<= entry_decode(cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>)
send_ldap_result: conn=1000 op=0 p=3
send_ldap_response: msgid=1 tag=97 err=49
ber_flush2: 14 bytes to sd 11
daemon: activity on 1 descriptor
daemon: activity on: 11r
daemon: read active on 11
daemon: epoll: listen=7 active_threads=0 tvp=NULL
connection_get(11): got connid=1000
connection_read(11): checking for input on id=1000
ber_get_next
ber_get_next on fd 11 failed errno=0 (Success)
connection_read(11): input error=-2 id=1000, closing.
connection_closing: readying conn=1000 sd=11 for close
daemon: activity on 1 descriptor
daemon: activity on:
daemon: epoll: listen=7 active_threads=0 tvp=NULL
connection_close: conn=1000 sd=11
daemon: removing 11
Same result with this policy:
access to dn.subtree="dc=<domain_1>,dc=<base>" by * write
I can access only with this policy:
access to * by * write
I compiled opneldap 2.4.21 with default settings
Here my slapd.conf:
include /sw/test_domain_openldap-2.4.21/etc/openldap/schema/core.schema
include /sw/test_domain_openldap-2.4.21/etc/openldap/schema/cosine.schema
pidfile /sw/test_domain_openldap-2.4.21/var/run/slapd.pid
argsfile /sw/test_domain_openldap-2.4.21/var/run/slapd.args
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=<base>"
rootdn "cn=Manager,dc=<base>"
rootpw testdomain
directory /sw/test_domain_openldap-2.4.21/var/openldap-data
index objectClass eq
access to * by * write
#access to dn.subtree="dc=<domain_1>,dc=<base>" by * write
#access to dn.subtree="dc=<domain_1>,dc=<base>" by dn="cn=Administrator1,ou=<domain_1>Administrators,o=Administrators,dc=<base>" write
thanks in advance!
Carlo