https://bugs.openldap.org/show_bug.cgi?id=9640
Issue ID: 9640 Summary: ACL privilege for MOD_INCREMENT Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: slapd Assignee: bugs@openldap.org Reporter: michael@stroeder.com Target Milestone: ---
I'm using LDAP write operations with MOD_INCREMENT with pre-read-control for uidNumber/gidNumber generation.
I'd like to limit write access to an Integer attribute "nextID" to MOD_INCREMENT, ideally even restricting the de-/increment value.
(Uniqueness is achieved with slapo-unique anyway but still I'd like to avoid users messing with this attribute).
IMHO the ideal solution would be a new privilege "i".
Example for limiting write access to increment by one and grant read access for using read control:
access to attrs=nextID val=1 by group=... =ri
Example for decrementing by two without read:
access to attrs=nextID val=-2 by group=... =i