From jasondearborn@gmail.com Fri Oct 26 20:42:43 2007
From: Jason Dearborn <jasondearborn@gmail.com>
To: openldap-software@openldap.org
Subject: Re: Access Control by group
Date: Fri, 26 Oct 2007 13:42:36 -0700
Message-ID: <4296d7270710261342x760ab552i66652f9bd3687702@mail.gmail.com>
In-Reply-To: <4296d7270710261330s328dff96sf0c2c1ab8a961404@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7830847384682601019=="

--===============7830847384682601019==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Ack.

Just found this:
http://www.openldap.org/lists/openldap-software/200710/msg00343.html
and this:
http://www.mail-archive.com/openldap-software(a)openldap.org/msg08524.html

Looks like other people are trying to work with posixGroups as well.



On 10/26/07, Jason Dearborn wrote:
>
> I'd like to grant members of an Administrator group full access to
> everything in LDAP.
>
> According to the ldap FAQ, the default objectclass is "groupOfNames" and
> the default attribute checked is "member".  To match my config I'd need to
> change the values to "posixGroup" and "memberUid" respectively.  It looks
> like you can do that with the following syntax:
>
> <who> ::= group[/<objectclass>[/<attrname>][.<style>]]=<pattern>]
>
> I can't find any examples on the web and I've been
> unsuccessful experimenting with various syntatical permutations.  slapd
> won't start with any of the following:
>
> access to *
>     by group/posixGroup="Admins,ou=Group,dc=example,dc=com" write
>
> access to *
>    by group/posixGroup/memberUid="Admins,ou=Group,dc=example,dc=com" write
>
> I'm running OpenLDAP 2.2.13-2
>
> Has anyone been able to make this work?
>
> TIA,
> Jason
>
>



--===============7830847384682601019==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.htm"
MIME-Version: 1.0

PGRpdj5BY2suPC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+CjxkaXY+SnVzdCBmb3VuZCZuYnNwO3Ro
aXM6PC9kaXY+CjxkaXY+PGEgaHJlZj0iaHR0cDovL3d3dy5vcGVubGRhcC5vcmcvbGlzdHMvb3Bl
bmxkYXAtc29mdHdhcmUvMjAwNzEwL21zZzAwMzQzLmh0bWwiPmh0dHA6Ly93d3cub3BlbmxkYXAu
b3JnL2xpc3RzL29wZW5sZGFwLXNvZnR3YXJlLzIwMDcxMC9tc2cwMDM0My5odG1sPC9hPjwvZGl2
Pgo8ZGl2PmFuZCB0aGlzOjwvZGl2Pgo8ZGl2PjxhIGhyZWY9Imh0dHA6Ly93d3cubWFpbC1hcmNo
aXZlLmNvbS9vcGVubGRhcC1zb2Z0d2FyZUBvcGVubGRhcC5vcmcvbXNnMDg1MjQuaHRtbCI+aHR0
cDovL3d3dy5tYWlsLWFyY2hpdmUuY29tL29wZW5sZGFwLXNvZnR3YXJlQG9wZW5sZGFwLm9yZy9t
c2cwODUyNC5odG1sPC9hPjwvZGl2Pgo8ZGl2PiZuYnNwOzwvZGl2Pgo8ZGl2Pkxvb2tzIGxpa2Ug
b3RoZXIgcGVvcGxlIGFyZSB0cnlpbmcgdG8gd29yayB3aXRoIHBvc2l4R3JvdXBzIGFzIHdlbGwu
PC9kaXY+CjxkaXY+PGJyPjxicj4mbmJzcDs8L2Rpdj4KPGRpdj48c3BhbiBjbGFzcz0iZ21haWxf
cXVvdGUiPk9uIDEwLzI2LzA3LCA8YiBjbGFzcz0iZ21haWxfc2VuZGVybmFtZSI+SmFzb24gRGVh
cmJvcm48L2I+IHdyb3RlOjwvc3Bhbj4KPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBz
dHlsZT0iUEFERElORy1MRUZUOiAxZXg7IE1BUkdJTjogMHB4IDBweCAwcHggMC44ZXg7IEJPUkRF
Ui1MRUZUOiAjY2NjIDFweCBzb2xpZCI+CjxkaXY+SSYjMzk7ZCBsaWtlIHRvIGdyYW50Jm5ic3A7
bWVtYmVycyBvZiBhbiBBZG1pbmlzdHJhdG9yIGdyb3VwIGZ1bGwgYWNjZXNzIHRvIGV2ZXJ5dGhp
bmcgaW4gTERBUC4mbmJzcDsmbmJzcDs8L2Rpdj4KPGRpdj4mbmJzcDs8L2Rpdj4KPGRpdj5BY2Nv
cmRpbmcgdG8gdGhlIGxkYXAgRkFRLCB0aGUgZGVmYXVsdCBvYmplY3RjbGFzcyBpcyAmcXVvdDtn
cm91cE9mTmFtZXMmcXVvdDsgYW5kIHRoZSBkZWZhdWx0IGF0dHJpYnV0ZSBjaGVja2VkIGlzICZx
dW90O21lbWJlciZxdW90Oy4mbmJzcDsgVG8gbWF0Y2gmbmJzcDtteSBjb25maWcgSSYjMzk7ZCBu
ZWVkIHRvIGNoYW5nZSB0aGUgdmFsdWVzIHRvICZxdW90O3Bvc2l4R3JvdXAmcXVvdDsgYW5kICZx
dW90O21lbWJlclVpZCZxdW90OyByZXNwZWN0aXZlbHkuJm5ic3A7IEl0IGxvb2tzIGxpa2UgeW91
IGNhbiBkbyB0aGF0IHdpdGggdGhlIGZvbGxvd2luZyBzeW50YXg6IAo8L2Rpdj4KPGRpdj4mbmJz
cDs8L2Rpdj4KPGRpdj4mbHQ7d2hvJmd0OyA6Oj0mbmJzcDtncm91cFsvJmx0O29iamVjdGNsYXNz
Jmd0O1svJmx0O2F0dHJuYW1lJmd0O11bLiZsdDtzdHlsZSZndDtdXT0mbHQ7cGF0dGVybiZndDtd
PC9kaXY+CjxkaXY+Jm5ic3A7PC9kaXY+CjxkaXY+SSBjYW4mIzM5O3QgZmluZCBhbnkgZXhhbXBs
ZXMgb24gdGhlIHdlYiBhbmQgSSYjMzk7dmUgYmVlbiB1bnN1Y2Nlc3NmdWwmbmJzcDtleHBlcmlt
ZW50aW5nIHdpdGggdmFyaW91cyZuYnNwO3N5bnRhdGljYWwgcGVybXV0YXRpb25zLiZuYnNwOyBz
bGFwZCB3b24mIzM5O3Qgc3RhcnQgd2l0aCBhbnkgb2YgdGhlIGZvbGxvd2luZzo8L2Rpdj4KPGRp
dj4mbmJzcDs8L2Rpdj4KPGRpdj5hY2Nlc3MgdG8gKjwvZGl2Pgo8ZGl2PiZuYnNwOyZuYnNwOyZu
YnNwOyBieSBncm91cC9wb3NpeEdyb3VwPSZxdW90O0FkbWlucyxvdT1Hcm91cCxkYz1leGFtcGxl
LGRjPWNvbSZxdW90OyB3cml0ZTwvZGl2Pgo8ZGl2PiZuYnNwOzwvZGl2Pgo8ZGl2PmFjY2VzcyB0
byAqPC9kaXY+CjxkaXY+Jm5ic3A7Jm5ic3A7IGJ5IGdyb3VwL3Bvc2l4R3JvdXAvbWVtYmVyVWlk
PSZxdW90O0FkbWlucyxvdT1Hcm91cCxkYz1leGFtcGxlLGRjPWNvbSZxdW90OyB3cml0ZTxicj4m
bmJzcDs8L2Rpdj4KPGRpdj5JJiMzOTttIHJ1bm5pbmcgT3BlbkxEQVAgMi4yLjEzLTI8L2Rpdj4K
PGRpdj4mbmJzcDs8L2Rpdj4KPGRpdj5IYXMgYW55b25lIGJlZW4gYWJsZSB0byBtYWtlIHRoaXMg
d29yaz88L2Rpdj4KPGRpdj4mbmJzcDs8L2Rpdj4KPGRpdj5USUEsPC9kaXY+PHNwYW4gY2xhc3M9
InNnIj4KPGRpdj5KYXNvbjwvZGl2Pgo8ZGl2PiZuYnNwOzwvZGl2Pjwvc3Bhbj48L2Jsb2NrcXVv
dGU+PC9kaXY+PGJyPgo=

--===============7830847384682601019==--