On Mon, Nov 20, 2006 at 11:00:46AM +0200, G?khan wrote:

Hello;

I have a question on LDAP search issue. I want to disable full search on the LDAP tree.

Eg:

My LDAP Tree is:

c=US, o=Dept1, cn=John Smith c=US, o=Dept1, cn=Ann Adams

I want to deny to read full listing of the tree but only allow when the search condition meets only the required person. In the example above I want nobody to be listed. But when the search criteria is "c=US, o=Dept1, cn=Ann Adams" this entry must be listed. When a search on "c=US" comes, nothing must be listed.

What is the correct Access Control Information for this request??

Something like: access to dn.children=c=US, o=Dept1 by * read access to dn.children=c=US, o=Dept2 by * read access to dn.sub=c=US by * deny

It's just untested idea. For details read slapd.access(5) about dnstyle

WBR

--On Monday, November 20, 2006 11:00 AM +0200 Gökhan gokhan.afacan@gmail.com wrote:

Hello;

I have a question on LDAP search issue. I want to disable full search on the LDAP tree.

Eg:

My LDAP Tree is:

c=US, o=Dept1, cn=John Smith c=US, o=Dept1, cn=Ann Adams

Out of curiosity, is this really how your tree is laid out in DN syntax? It is the reverse of how things are generally done in LDAP. What I'd expect is something like:

cn=John Smith,o=Dept1,c=US cn=Ann Adams,o=Dept1,c=US

--Quanah

-- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html