That is a usefull link. Thank you! I finally manage this way:
access to dn.Subtree="ou=contacts,ou=people,dc=mcm,dc=com" by dn.Subtree="ou=administradores,ou=people,dc=mcm,dc=com" write by * read
What I wanted is to create a group of administrator to control everything and a group of normal users with only access control in their groups contacts.
I will also apply the group configuration you send me, thanks!
On Thu, 2009-01-29 at 17:25 +0100, Michael Ströder wrote:
Miguel wrote:
I m trying to configure the ldap . I have created two groups (contact and administradores) within another one (people).
I would like administradores group to have all the permissions over contacts group. I have modified the slapd.conf in this way, but it doesn't work:
access to dn=".*,ou=contacts,ou=people,dc=mcm,dc=com" by dn=".*,ou=administradores,ou=people,dc=mcm,dc=com" write by * read
You should consult the fine FAQ - in particular:
"How do I use groups to manage access control?"
http://www.openldap.org/faq/data/cache/52.html
Ciao, Michael.