[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ACL to deny deletes but allow entry creation.

To: Aravind Gottipati <aravind@freeshell.org>
Subject: Re: ACL to deny deletes but allow entry creation.
From: Howard Chu <hyc@symas.com>
Date: Sat, 24 Apr 2010 19:27:04 -0700
Cc: openldap-software@openldap.org
In-reply-to: <v2va1348d631004241640y2854dce9vd367041b9a610b5b@mail.gmail.com>
References: <v2va1348d631004241640y2854dce9vd367041b9a610b5b@mail.gmail.com>
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; rv:1.9.3a5pre) Gecko/20100413 Firefox 3.6

Aravind Gottipati wrote:

Hi,

I am working on an application where we want to grant an admin account
the privileges to create new entries, but prevent any further changes
(or deletes) to the entry by the admin account.  I have looked through
the docs and the faqs for this, and I am pretty sure that this is not
possible.  The simile folks relate this with, is the ability to grant
insert privileges to an account in mysql, but restrict selects,
updates etc..  Before I tell the developers that this is not possible,
I wanted to check with you folks first.  Have Any of you encountered
similar situations?  How do others deal with cases like this?

It is of course possible. Read the slapd.access(5) manpage. Note that wadd andwdel are separate privileges.


--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/

References:
- ACL to deny deletes but allow entry creation.
  - From: Aravind Gottipati <aravind@freeshell.org>

Prev by Date: Re: ACL to deny deletes but allow entry creation.
Next by Date: Re: N-way multimaster replication problem
Index(es):
- Chronological
- Thread