Hi all,
I'm not very experienced with ldap. I've been looking into the access controls documentation but I'm unsure on what the proper way to handle this is.
So let me expain what I want to accomplish: a user entry (posixAccount, password, givenName, ...) can update his own password by using the "self" keyword. All good there. But a user has some assets he owns. For example a host (in Common tree).
I want the user to be able to update one attribute of this host.
"self" keyword doesn't work here as the user doesn't bind to it.
So I added an owner attribute to the host and with that attribute I reference to the user.
Now I need some kind of "glue" to verify that the user is allowed to write to the attribute.
Do I need a filter? Wouldn't this just filter out a specific attribute? Or will it only filter entries based on the filter match?
In the latter case (which seems like a logical way for openldap to handle this) I would need:
- attr: to select what attribute the user access is modified
- filter: to only apply on the user his host
- by: variable definition for this clause to only apply on the binded user
I've read about dnattr but I'm unsure this is accomplishes what I want.
Could anyone share an example?
Thanks