[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: ACL control with break
On Sat, 26 May 2012, Nick Milas wrote:
> On 25/5/2012 6:59 ??, Nick Milas wrote:
> > You mean that if we use a <what> statement without an "attrs=" clause,
> > then it affects children and entry pseudo-attributes as well? And what
> > if there is a filter specified too (still without an "attrs=" clause)?
>
> From some research I did (e.g.:
> http://www.openldap.org/faq/data/cache/1140.html), I don't see cases of
> implicit change (meant as described above) of entry and children
> pseudo-attributes.
You didn't see the last example on that page?
----
access to dn.onelevel="dc=example,dc=com"
by dnattr=creatorsName write
by * read
----
No attrs clause, and yet for the behavior described there to work it must
be giving access to the 'entry' pseudo-attr.
> In case we would like an ACL statement to include all attributes *plus*
> the pseudo-attributes, then we should explicitly specify, for example:
>
> access to dn.subtree="ou=people,dc=example,dc=com"
> attrs="@extensibleObject,children,entry"
> by dn.exact="uid=admin,ou=people,dc=example,dc=com" write
> ...
@extensibleObject covers *EVERYTHING*, including the pseudo-attrs entry
and children.
> If anyone has more details on this, I would appreciate your feecback.
Let's do something *crazy*: let's *actually try it*!
I added the following two acls to an existing server
-----
# Just needed so I can add dc=testing...
access to dn.exact="" attrs=children
by dn.exact="mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com" write
access to dn.sub="dc=testing"
by dn.exact="mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com" write
-----
This server had no dc=testing tree at this point. With those ACLs
present, I was then able to bind as the indicated user and create a
dc=testing entry and an entry below it:
$ ldapadd -D mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com -w foobar
dn: dc=testing
changetype: add
objectclass: domain
dc: testing
adding new entry "dc=testing"
dn: ou=foo,dc=testing
objectClass: organizationalUnit
ou: foo
adding new entry "ou=foo,dc=testing"
$
So, no attrs clause on the second ACL but I was able to create entries
covered by it.
I then replaced those two ACLs with this single one:
-----
access to dn.sub="dc=testing" attrs="objectclass,ou,entry"
by dn.exact="mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com" write
-----
I.e., the ACL no longer gives write access to the 'children'
pseudo-attribute.
Adding an entry then fails:
$ ldapadd -D mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com -w foobar
dn: ou=baz,dc=testing
objectClass: organizationalUnit
ou: baz
adding new entry "ou=baz,dc=testing"
ldap_add: Insufficient access (50)
additional info: no write access to parent
$
I then updated that ACL to include children:
-----
access to dn.sub="dc=testing" attrs="objectclass,ou,entry,children"
by dn.exact="mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com" write
-----
...and now the same add succeeds:
$ ldapadd -D mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com -w
foobar
dn: ou=baz,dc=testing
objectClass: organizationalUnit
ou: baz
adding new entry "ou=baz,dc=testing"
$
Those two tests together show that the server is indeed checking for the
'children' attr, so it's not that it just wasn't looking.
Finally, let's try using attrs="@extensibleObject" (I only mention it
because that's what the *documention* says is the default.)
-----
access to dn.sub="dc=testing" attrs="@extensibleObject"
by dn.exact="mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com" write
-----
$ ldapadd -D mailRoutingAddress=foo@foo.com,ou=People,dc=foo,dc=com -w
foobar
dn: ou=quux,dc=testing
objectClass: organizationalUnit
ou: quux
adding new entry "ou=quux,dc=testing"
$
So @extensibleObject clearly must cover 'children'.
I suggest you set up a similar test environment and play around with some
ACLs on a real system. Less theory and more practice will lead to faster
results. For example, you could set up an ACL with a filter clause and
answer your own question about whether that affects the attrs matched.
Philip