Re: OLC permissions - general beginner question

[Ferenc Wagner <wferi@niif.hu>]

Stefan Bauer <sb@plzk.de> writes:

> I only have the cn=config DIT available.

(You actually have cn=monitor, too.)

> dn: olcDatabase={0}config,cn=config
> olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none
> [...]
> so it looks like only UID=0 (root) should be able to interoperate with
> the directory. However all local users can connect but do not have
> access to cn=config (this is expected).
>
> [user@host ~]$ ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config'
> [...]
> search: 2
> result: 32 No such object
>
> So why am i even able to logon and state a query?

You do not "logon", you use external authentication, which means there's
no separate BIND step, like with simple bind (-x) for example.  External
authenication is not done by slapd (hence its name; it's done by the
kernel in the above case), thus slapd can't fail it.  The only LDAP
operation it sees is a search, and the authenticated DN
(gidNumber=X+uidNumber=Y,...) is not authorized for that, so the result
is "No such object".  As ACLs belong to target objects, they are not
suitable for forcing server disconnection as soon as the authenticated
DN is known.  Maybe LDAP doesn't even allow such behaviour.
-- 
Regards,
Feri.