[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: OpenLDAP permissions question
Hello Dan and Michael,
I have a server with a config database and a few DIT databases. I use
online configuration. A little white ago, I knew nothing about
OpenLDAP. Now, your help, I understand a lot more, yet still little
and able to achieve even less..
I want individual administrators [those from within each DIT] to be
able to browse within their tree, and cn=config administrator to be
able to search through all records on the server, across DITs. If this
is too difficult, I would go for LDAPI.
As a temporary workaround, LDAPI would be amazing.
None of it working, yet. I tried a bunch of suggestions, many of which
I don't fully understand. Nothing worked so far.
Specifically, I cannot understand why should not the below applied to
the config database does not work, if I did set the password.
olcAccess: {0}to * by dn="cn=config" manage
Sincerely,
Igor Shmukler
On Thu, Mar 19, 2015 at 11:16 PM, Dan White <dwhite@cafedemocracy.org> wrote:
> On 03/19/15 23:05 +0200, Igor Shmukler wrote:
>>
>> Hello Dan,
>>
>> I must have done something wrong, yet this thing did not work either.
>> One: the delete still failed with the usual error, and second - I got
>> an error concerning my olcs:
>>
>> 550b380f /etc/ldap/slapd.d: line 1: rootdn is always granted unlimited
>> privileges.
>> 550b380f olcRootPW: value #0: <olcRootPW> can only be set when rootdn
>> is under suffix
>
>
> You don't need to set olcRootPW in this case. See slapd-config(5).
>
> --
> Dan White