Re: ACL Question

[Diego Lima <lists@diegolima.org>]

Hi again!

I managed to get it working by doing this:

Access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org$"
  by dn.exact,expand="cn=$1,ou=users,dc=diegolima,dc=org" write
  by * read

Access to dn="ou=Misc,dc=diegolima,dc=org" attrs=children
  by users write
  by * read


I actually needed to use "dn.exact,expand" instead of just "dn.expand"
as it was not matching the client properly. I'm still trying to figure
out why, so if anyone can explain this to me I'd be very appreciative
:)

Anyway, its working now! Thank you!

2010/9/30 Christian Manal <moenoel@informatik.uni-bremen.de>:
> Am 30.09.2010 02:04, schrieb Diego Lima:
>> Hello all,
>>
>> I have the following structure on my LDAP server:
>>
>> ou=Misc,dc=diegolima,dc=org
>> ou=Users,dc=diegolima,dc=org
>>
>> Under users I have some user accounts, such as
>> cn=user1,ou=Users,dc=diegolima,dc=org. I'd like to allow users to
>> create an OU under ou=Misc as long as the OU had the user's name, such
>> as ou=user1,ou=Misc,dc=diegolima,dc=org for user1 or
>> ou=user2,ou=Misc,dc=diegolima,dc=org for user2, however I wouldn't
>> like to simply create an ACL such as:
>>
>> access to dn.exact="ou=Misc,dc=diegolima,dc=org"
>>     by * add
>>
>> as this ultimately allows user1 to create an ou named
>> "ou=user2,ou=Misc". What I first tried was adding an ACL like this:
>>
>> access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org"
>>     by dn.exact,expand="cn=$1,dc=diegolima,dc=org" write
>>     by * none
>>
>>
>> However I receive an error telling me that I need write access to the
>> parent entry to create this, and if I use the first ACL I seem to be
>> able to create OUs without any naming restriction. Is there even a way
>> to accomplish this?
>>
>> Thank you very much!
>>
>
> Hi,
>
> I think you need to add write permissions for the pseudo attribute
> "children" of the parent. I.E. something like this:
>
>
>   access to dn="ou=Misc,dc=diegolima,dc=org" attrs=children
>      by users write
>      by * none
>
>   access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org$"
>      by dn.expand="cn=$1,ou=Users,dc=diegolima,dc=org" write
>      by * none
>
>
> That way, all authenticated users are allowed to write to child entries
> of "ou=Misc,..." and the "dn.regex" rule then restricts to which
> children users may write.
>
>
> Regards,
> Christian Manal
>



-- 
Diego Lima