[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object

On 01-04-14 10:53, Terje Trane wrote:
On 01.04.2014 09:58, Jonas Kellens wrote:

even if I add at the beginning of slapd.conf the following :

access to * by *

I still get no results with the user 'cn=U101001,ou=101001,dc=mydomain'

I only get result with 'cn=Manager,dc=mydomain'


Remember that ACLs are  "first match used".

If a database does not have an ACL the global ACL applies.

But if it has a database specific ACL, that one is read first when accessing that particular database, and the global then *only* used if there is no match (or a control keyword like break or continue is specified)

 I posted it before, but will post it again. This is the database specific ACL :

database        bdb
suffix          "dc=mydomain"
rootdn          "cn=Manager,dc=mydomain"
rootpw         {SSHA}blCAG/CNdFPY597Cf4Ssuj

access to attrs=userPassword
        by * auth

access to dn.regex="ou=tbook[12345],ou=contacten,ou=101001,dc=mydomain" attrs=children
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by * none break

access to dn.
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read

access to dn.
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by group.exact="cn=tbook2,ou=gebruikers,ou=101001,dc=mydomain" read

access to dn.
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by group.exact="cn=tbook3,ou=gebruikers,ou=101001,dc=mydomain" read

access to dn.
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by group.exact="cn=tbook4,ou=gebruikers,ou=101001,dc=mydomain" read

access to dn.
        by group.exact="cn=admins,ou=101001,dc=mydomain" write
        by group.exact="cn=tbook5,ou=gebruikers,ou=101001,dc=mydomain" read


If user 'cn=U101001,ou=101001,dc=mydomain' is member of group "cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain", wouldn't you agree that it should be able to read the entries in dn "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" ??



Kind regards,
Jonas.