ACL advice needed ...

["Zeus Panchenko" <zeus@ibs.dn.ua>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

greetings,

I'm trying to configure ACL, I belive it is possible to ... but after
some attempts I doubt it is ...

please, help me to understand where I'm making the mistake/s ...

I need to manage possibility for "coadmins" group members to manage all
except the objects of "admins" group members

forgive me please my long explanation ...

so I have:

Important: the starting point in my case is auth accounts structure:

users do auth with (lets call it) "root" objects (most upper level):
uid=<USER>,ou=People,dc=abc

- ---[ accounts and groups start ]-------------------------------------------
dn: uid=admin1,ou=People,dc=abc
dn: uid=admin7,ou=People,dc=abc
dn: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc

dn: uid=coadmin5,ou=People,dc=abc
dn: uid=johndoe,authorizedService=serviceA,uid=coadmin5,ou=People,dc=abc

dn: uid=coadmin6,ou=People,dc=abc

dn: cn=admins,dc=abc
memberUid: admin1
- ---[ accounts and groups end   ]-------------------------------------------

group objects memberUid attribute value contains uid of the "root"
objects

- ---[ group structure start ]-------------------------------------------
dn: cn=coadmins,ou=group,dc=abc
memberUid: coadmin5
memberUid: coadmin6
- ---[ group structure end   ]-------------------------------------------


here is the ACL I managed to work as I want:

- ---[ quotation start ]-------------------------------------------
access to dn.subtree="dc=abc" attrs=userPassword
        by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage
        by set.exact="this/-2 & user" write
        by self write
        by anonymous auth
        by * break
- ---[ quotation end   ]-------------------------------------------

this allows admins to manage passwords of anybody and for all other
users manage passwords of self "root" account and service accounts (look
structure of account objects above)


and now, I had a hope to do the same to get possibility for coadmins to manage
passwords of anybody except admins, and here what I thought about:

- ---[ quotation start ]-------------------------------------------
access to dn.subtree="dc=abc" attrs=userPassword
        by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage
        by set="(([cn=admin,ou=group,dc=abc]/memberUid & this/uid) | ([cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid)) & ([cn=coadmin,ou=group,dc=abc]/memberUid & user/uid)" disclose
        by set="[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" manage
        by set.exact="this/-2 & user" write
        by self write
        by anonymous auth
        by * break
- ---[ quotation end   ]-------------------------------------------

and it doesn't work


the initial idea of the second `by set=' row is:
for coadmins to disallow all access to userPassword if account belongs to admin 

am I right to expect:

1.1. "[cn=admin,ou=group,dc=abc]/memberUid & this/uid" 
     is true if uid of current record is member of the group `admin'

     when `this' is the very "root" account (uid=admin7,ou=People,dc=abc)

1.2. "[cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid"
     uid of the "root" account (uid=admin7,ou=People,dc=abc) is admin group member

     when `this' is service account like:
     uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc
     `this/-2' trimms it to `uid=admin7,ou=People,dc=abc' and `/uid' have to provide uid value

1.3. "[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid"
     true if currently loggedin user uid is coadmin group member


so ... was I successfull to explain what I want? :)

- -- 
Zeus V. Panchenko				jid:zeus@im.ibs.dn.ua
IT Dpt., I.B.S. LLC					  GMT+2 (EET)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlhFk1kACgkQr3jpPg/3oyp7XgCggcp9Y909JRQOknE7GkgjmZpw
/sYAoIyimb3gcy38qZAjlyHfbF+rH63a
=aqts
-----END PGP SIGNATURE-----