openldap-software

openldap-software@openldap.org

2719 discussions

Overlays proxycache and failover
by Sébastien CAMELLINI 10 Mar '09

10 Mar '09

Hie, I have one ldap proxy server and 2 ldap servers in mirror mode with syncrep. My proxy ldap server ask all to one of the two servers in mirror mode. l'm trying to find a way to specifie in the proxy ldap config to ask all to the second server when the first is down. Thank you for your help, Sebastien CAMELLINI

3 2

Re: set ACL specification/syntax
by Andrew Cobaugh 09 Mar '09

09 Mar '09

On Fri, Mar 6, 2009 at 4:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > > If you set the cn value on every group they are supposed to be able to write > to, then they'll be able to write to any of those groups. I.e., "this/cn" > is the group entry in question. I'm assuming you want them to be able to > write to any group they have control of. If you don't, then simply remove > the cn=uid value from the group. Perhaps I didn't articulate my point well enough. I want them to be able to *create* these entries on their own, they won't be pre-created. So, I want them to be able to create entries under ou=group but only if they are of the form uid:.+ --andy

2 2

ACL and multiple mandatory conditions
by manu＠netbsd.org 07 Mar '09

07 Mar '09

Hello The goal is to give access to a ressource based on two mandatory conditions. I want user DN to match a rule, and attribute value to match another rule, which depends on the user This yields me two rules. The first one allow a user that has a given ou in ouManager set to modify the authorizedService in this ou. I did not test the second one yet, but the idea is that the user has a serviceManager attribute telling which value of authorizedService he is allowed to set. access to dn.regex="^uid=.+,ou=.+,o=home$" attrs=authorizedService by set.exact="user/ouManager & this/-1" write stop access to attrs.regex=authorizedService val.regex="(.*)" by set="user/serviceManager & ${v1}" write stop But I need to perform a AND between the two rules. How can that be done? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 5

"slapadd could not parse entry" & "ldap_add: Invalid syntax (21)" errors
by Yan Simkin 07 Mar '09

07 Mar '09

Hi, I'm trying to import the LDIF file (attached), but both comands return an error. The "slapadd" says there's a problem to parse and entry and the "ldapadd" announces syntax problems. I've been fighting that for a whole day, no success. I attach hereto the LDIF file, the CONF file and both error outputs. Any help will be greatly appreciated. Thanks! -- Regards, Yan

3 2

Re: "slapadd could not parse entry" & "ldap_add: Invalid syntax (21)" errors
by Yan Simkin 06 Mar '09

06 Mar '09

This is what I thought, but what schema defines "domain"? Thanks for the help. On Fri, Mar 6, 2009 at 6:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, March 06, 2009 4:51 PM -0500 Yan Simkin <bushmills(a)gmail.com> > wrote: > > Hi, >> >> I'm trying to import the LDIF file (attached), but both comands return an >> error. The "slapadd" says there's a problem to parse and entry and the >> "ldapadd" announces syntax problems. I've been fighting that for a whole >> day, no success. >> >> I attach hereto the LDIF file, the CONF file and both error outputs. >> >> Any help will be greatly appreciated. >> > > ldap_add: Invalid syntax (21) > additional info: objectClass: value #2 invalid per syntax > > That means the 3rd objectClass value (as they are zero based) is not valid. > Either you are missing the schema for it (i.e., you haven't loaded it), or > it's not an objectClass. Fix your data. > > It would look like it doesn't like: > > objectClass: domain > > so you need to fix why it doesn't like that OC. Maybe you didn't load the > schema that defines it. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: set ACL specification/syntax
by Andrew Cobaugh 06 Mar '09

06 Mar '09

On Fri, Mar 6, 2009 at 4:45 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Which ACL is "This ACL"? access to dn.subtree="ou=group,dc=mydomain" by set="this/cn & user/uid" write > Have you turned on acl level debugging to see what exactly is occurring when > you go to do operations? Yes, and it is falling right past the above acl and hitting the catchall for the top of the directory for * read. > Also, what OpenLDAP release are you using? Heh, OpenLDAP 2.4.11. Old I know, I've been meaning to go back to a stable 2.3 for some time, but 2.4.x had certain fixes for the translucent overlay that I needed, which I don't need anymore. --andy

1 0

Re: set ACL specification/syntax
by Andrew Cobaugh 06 Mar '09

06 Mar '09

On Fri, Mar 6, 2009 at 4:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > As documented, ACLs are evaluated in the order they are hit. So if you have > a by * read at the top of your ACLs, then of course nothing after that will > be evaluated. This ACL is the first listed in the config file. In debug, it's also the first that it reads from the config file. --andy

2 1

Re: set ACL specification/syntax
by Quanah Gibson-Mount 06 Mar '09

06 Mar '09

--On Friday, March 06, 2009 4:10 PM -0500 Andrew Cobaugh <phalenor(a)gmail.com> wrote: > Weird, this isn't matching: > > access to dn.children="ou=group,dc=mydoman" > by set="this/cn & user/uid" write > > Instead, it's falling through to the "by * read" entry at the top of the > tree. > > It doesn't even look like it's trying to match against that ACL, actually. As documented, ACLs are evaluated in the order they are hit. So if you have a by * read at the top of your ACLs, then of course nothing after that will be evaluated. I suggest you closely read slapd-access(5). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: set ACL specification/syntax
by Quanah Gibson-Mount 06 Mar '09

06 Mar '09

--On Friday, March 06, 2009 4:04 PM -0500 Andrew Cobaugh <phalenor(a)gmail.com> wrote: > On Fri, Mar 6, 2009 at 3:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: >> --On Friday, March 06, 2009 3:46 PM -0500 Andrew Cobaugh >> <phalenor(a)gmail.com> wrote: >> >>> Hi all, >>> >>> I think the set clause should at least be based on something like, >>> set="this/cn & user/uid" but with extra stuff in there to require a >>> colon and one or more characters only. >> >> Add a second cn value to the entry that matches the uid. That way >> this/cn would match. cn is multivalued afterall. ;) > > Hmm, not sure that would work, as there are already entries like that > (everyone gets a group that matches their uid, which becomes their > primary posix group). > > Let me try it and see if it breaks anything... Please keep replies on the list. If you set the cn value on every group they are supposed to be able to write to, then they'll be able to write to any of those groups. I.e., "this/cn" is the group entry in question. I'm assuming you want them to be able to write to any group they have control of. If you don't, then simply remove the cn=uid value from the group. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

set ACL specification/syntax
by Andrew Cobaugh 06 Mar '09

06 Mar '09

Hi all, I'm trying to set up 'personal' groups with ACLs that allow my users to directly create and modify their own personal group. For me, personal groups are of the form "cn=uid:groupname,ou=group,dc=mydomain" So far I've had partial success. If the group already exists, the user can modify that entry. What I'm struggling with is how to allow authenticated users to create entries of the form uid:foo under the group ou, i.e. grant write access to the children of ou=group. I *think* I can use "by set=<something>", but I haven't quite gotten the grasp of it, and there are very few references to using 'set' online (at least that I've found). I was hoping someone on this list has either done something like this before, or could point me in the right direction. I think the set clause should at least be based on something like, set="this/cn & user/uid" but with extra stuff in there to require a colon and one or more characters only. Ideas? --andy

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software