From jasondearborn@gmail.com Fri Oct 26 20:30:59 2007
From: Jason Dearborn <jasondearborn@gmail.com>
To: openldap-software@openldap.org
Subject: Access Control by group
Date: Fri, 26 Oct 2007 13:30:53 -0700
Message-ID: <4296d7270710261330s328dff96sf0c2c1ab8a961404@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0869947652784034342=="

--===============0869947652784034342==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

I'd like to grant members of an Administrator group full access to
everything in LDAP.

According to the ldap FAQ, the default objectclass is "groupOfNames" and the
default attribute checked is "member".  To match my config I'd need to
change the values to "posixGroup" and "memberUid" respectively.  It looks
like you can do that with the following syntax:

<who> ::= group[/<objectclass>[/<attrname>][.<style>]]=<pattern>]

I can't find any examples on the web and I've been
unsuccessful experimenting with various syntatical permutations.  slapd
won't start with any of the following:

access to *
    by group/posixGroup="Admins,ou=Group,dc=example,dc=com" write

access to *
   by group/posixGroup/memberUid="Admins,ou=Group,dc=example,dc=com" write

I'm running OpenLDAP 2.2.13-2

Has anyone been able to make this work?

TIA,
Jason



--===============0869947652784034342==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.htm"
MIME-Version: 1.0

PGRpdj5JJiMzOTtkIGxpa2UgdG8gZ3JhbnQmbmJzcDttZW1iZXJzIG9mIGFuIEFkbWluaXN0cmF0
b3IgZ3JvdXAgZnVsbCBhY2Nlc3MgdG8gZXZlcnl0aGluZyBpbiBMREFQLiZuYnNwOyZuYnNwOzwv
ZGl2Pgo8ZGl2PiZuYnNwOzwvZGl2Pgo8ZGl2PkFjY29yZGluZyB0byB0aGUgbGRhcCBGQVEsIHRo
ZSBkZWZhdWx0IG9iamVjdGNsYXNzIGlzICZxdW90O2dyb3VwT2ZOYW1lcyZxdW90OyBhbmQgdGhl
IGRlZmF1bHQgYXR0cmlidXRlIGNoZWNrZWQgaXMgJnF1b3Q7bWVtYmVyJnF1b3Q7LiZuYnNwOyBU
byBtYXRjaCZuYnNwO215IGNvbmZpZyBJJiMzOTtkIG5lZWQgdG8gY2hhbmdlIHRoZSB2YWx1ZXMg
dG8gJnF1b3Q7cG9zaXhHcm91cCZxdW90OyBhbmQgJnF1b3Q7bWVtYmVyVWlkJnF1b3Q7IHJlc3Bl
Y3RpdmVseS4mbmJzcDsgSXQgbG9va3MgbGlrZSB5b3UgY2FuIGRvIHRoYXQgd2l0aCB0aGUgZm9s
bG93aW5nIHN5bnRheDoKPC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+CjxkaXY+Jmx0O3dobyZndDsg
Ojo9Jm5ic3A7Z3JvdXBbLyZsdDtvYmplY3RjbGFzcyZndDtbLyZsdDthdHRybmFtZSZndDtdWy4m
bHQ7c3R5bGUmZ3Q7XV09Jmx0O3BhdHRlcm4mZ3Q7XTwvZGl2Pgo8ZGl2PiZuYnNwOzwvZGl2Pgo8
ZGl2PkkgY2FuJiMzOTt0IGZpbmQgYW55IGV4YW1wbGVzIG9uIHRoZSB3ZWIgYW5kIEkmIzM5O3Zl
IGJlZW4gdW5zdWNjZXNzZnVsJm5ic3A7ZXhwZXJpbWVudGluZyB3aXRoIHZhcmlvdXMmbmJzcDtz
eW50YXRpY2FsIHBlcm11dGF0aW9ucy4mbmJzcDsgc2xhcGQgd29uJiMzOTt0IHN0YXJ0IHdpdGgg
YW55IG9mIHRoZSBmb2xsb3dpbmc6PC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+CjxkaXY+YWNjZXNz
IHRvICo8L2Rpdj4KPGRpdj4mbmJzcDsmbmJzcDsmbmJzcDsgYnkgZ3JvdXAvcG9zaXhHcm91cD0m
cXVvdDtBZG1pbnMsb3U9R3JvdXAsZGM9ZXhhbXBsZSxkYz1jb20mcXVvdDsgd3JpdGU8L2Rpdj4K
PGRpdj4mbmJzcDs8L2Rpdj4KPGRpdj5hY2Nlc3MgdG8gKjwvZGl2Pgo8ZGl2PiZuYnNwOyZuYnNw
OyBieSBncm91cC9wb3NpeEdyb3VwL21lbWJlclVpZD0mcXVvdDtBZG1pbnMsb3U9R3JvdXAsZGM9
ZXhhbXBsZSxkYz1jb20mcXVvdDsgd3JpdGU8YnI+Jm5ic3A7PC9kaXY+CjxkaXY+SSYjMzk7bSBy
dW5uaW5nIE9wZW5MREFQIDIuMi4xMy0yPC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+CjxkaXY+SGFz
IGFueW9uZSBiZWVuIGFibGUgdG8gbWFrZSB0aGlzIHdvcms/PC9kaXY+CjxkaXY+Jm5ic3A7PC9k
aXY+CjxkaXY+VElBLDwvZGl2Pgo8ZGl2Pkphc29uPC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+Cg==

--===============0869947652784034342==--