Hi
I am trying to garnt users access to a group by there group membership. Because the groups are posixgroups and not groupofnames I have tried the following ACL's according to (running openldap-2.3.27-5)
http://www.openldap.org/faq/data/cache/1133.html and http://www.mail-archive.com/openldap-software@openldap.org/msg08524.html
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv]) & user" write by * none
or
by set="user/uid & [cn=Domain Admins,ou=Groups,dc=byn,dc=drv]/memberUid" write
The group has the folowing members
dn: cn=Domain Admins,ou=Groups,dc=byn,dc=drv memberUid: NetAdmin1 memberUid: Netadmin5 memberUid: NT_IEXPLORE memberUid: Siadmin memberUid: Netadmin3 memberUid: NT_FSecure
but a search as uid=Netadmin3,ou=Users,dc=byn,dc=drv
does not succeedd
Here the logs
Oct 26 12:41:11 master slapd[18574]: => access_allowed: search access to "cn=Domain Admins,ou=Groups,dc=byn,dc=drv" "cn" requested Oct 26 12:41:11 master slapd[18574]: => dn: [3] cn=domain admins,ou=groups,dc=byn,dc=drv Oct 26 12:41:11 master slapd[18574]: => acl_get: [3] matched Oct 26 12:41:11 master slapd[18574]: => acl_get: [3] attr cn Oct 26 12:41:11 master slapd[18574]: => acl_mask: access to entry "cn=Domain Admins,ou=Groups,dc=byn,dc=drv", attr "cn" requested Oct 26 12:41:11 master slapd[18574]: => acl_mask: to value by "uid=netadmin3,ou=users,dc=byn,dc=drv", (=0) Oct 26 12:41:11 master slapd[18574]: <= check a_set_pat: ([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv]) & user Oct 26 12:41:11 master slapd[18574]: >>> dnNormalize: <cn=domain admins,ou=groups,dc=byn,dc=drv> Oct 26 12:41:11 master slapd[18574]: <<< dnNormalize: <cn=domain admins,ou=groups,dc=byn,dc=drv> Oct 26 12:41:11 master slapd[18574]: <= check a_dn_pat: * Oct 26 12:41:11 master slapd[18574]: <= acl_mask: [2] applying none(=0) (stop) Oct 26 12:41:11 master slapd[18574]: <= acl_mask: [2] mask: none(=0) Oct 26 12:41:11 master slapd[18574]: => access_allowed: search access denied by none(=0)
If I use something simple like by set="([uid=] + user/uid + [,ou=users,dc=byn,dc=drv]) & user " write in order to test if by set works, the search works
Oct 26 12:35:45 master slapd[18488]: => acl_mask: to value by "uid=netadmin3,ou=users,dc=byn,dc=drv", (=0) Oct 26 12:35:45 master slapd[18488]: <= check a_set_pat: ([uid=] + user/uid + [,ou=users,dc=byn,dc=drv]) & user Oct 26 12:35:45 master slapd[18488]: >>> dnNormalize: <uid=netadmin3,ou=users,dc=byn,dc=drv> Oct 26 12:35:45 master slapd[18488]: <<< dnNormalize: <uid=netadmin3,ou=users,dc=byn,dc=drv> Oct 26 12:35:45 master slapd[18488]: => bdb_entry_get: ndn: "uid=netadmin3,ou=users,dc=byn,dc=drv" Oct 26 12:35:45 master slapd[18488]: => bdb_entry_get: oc: "(null)", at: "uid" Oct 26 12:35:45 master slapd[18488]: bdb_dn2entry("uid=netadmin3,ou=users,dc=byn,dc=drv") Oct 26 12:35:45 master slapd[18488]: => bdb_entry_get: found entry: "uid=netadmin3,ou=users,dc=byn,dc=drv" Oct 26 12:35:45 master slapd[18488]: bdb_entry_get: rc=0 Oct 26 12:35:45 master slapd[18488]: <= acl_mask: [1] applying write(=wrscxd) (stop) Oct 26 12:35:45 master slapd[18488]: <= acl_mask: [1] mask: write(=wrscxd) Oct 26 12:35:45 master slapd[18488]: => access_allowed: read access granted by write(=wrscxd) Oct 26 12:35:45 master slapd[18488]: conn=0 op=1 ENTRY dn="cn=domain admins,ou=groups,dc=byn,dc=drv"
It seems that the ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid is not expanded to all members I have tried several cases (Groups or groups) with no success.
Is this the correct way of using posixgroups for ldap acl's? If not, what is the right way? If yes, what am I doing wrong?
greetings
hansjörg
Dr. Hansjörg Maurer wrote:
I am trying to garnt users access to a group by there group membership. Because the groups are posixgroups and not groupofnames I have tried the following ACL's according to (running openldap-2.3.27-5)
http://www.openldap.org/faq/data/cache/1133.html and http://www.mail-archive.com/openldap-software@openldap.org/msg08524.html
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv]) & user" write by * none
or
by set="user/uid & [cn=Domain Admins,ou=Groups,dc=byn,dc=drv]/memberUid" write
The group has the folowing members
dn: cn=Domain Admins,ou=Groups,dc=byn,dc=drv memberUid: NetAdmin1 memberUid: Netadmin5 memberUid: NT_IEXPLORE memberUid: Siadmin memberUid: Netadmin3 memberUid: NT_FSecure
but a search as uid=Netadmin3,ou=Users,dc=byn,dc=drv
does not succeedd
<snip>
If I use something simple like by set="([uid=] + user/uid + [,ou=users,dc=byn,dc=drv]) & user " write in order to test if by set works, the search works
<snip>
It seems that the ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid is not expanded to all members I have tried several cases (Groups or groups) with no success.
Is this the correct way of using posixgroups for ldap acl's? If not, what is the right way? If yes, what am I doing wrong?
I'm just guessing, as I realize that sets' logging is not enough to investigate this type of issues (we may need to add some more verbose logging about sets' expansion). However, it seems to me that you're intermixing uid and memberUid; the two have rather different syntaxes and EQUALITY matchin rules:
- uid: directoryString and caseIgnoreMatch
- memberUid: IA5string and caseExactIA5Match
This may result in issues like: DNs containing an uid expanded from a memberUid value are normalized according to uid's matching, and thus lowercase; while DNs constructed using memberUid directly hold the value with uppercase chars, thus failing the final case-sensitive match. This could explain why the second rule, which uses uid to build a DN that's compared to the user's DN, works, while the first one, containing memberUid values, fails. And this is yet another example that shows why using posix membership for access control "Is Bad" (TM).
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati@sys-net.it ---------------------------------------
Pierangelo Masarati wrote:
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv]) & user" write by * none
You can check if my analysis was correct and, in that case, work your issue around, by adding another layer of dereferencing to constructed DNs, thus forcing them to be normalized according to uid instead of using memberUid's value. The above rule could be modified as
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv])/entryDN & user" write
(remove all line wrapping, of course).
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati@sys-net.it ---------------------------------------
Hi
this works. Thank you very much. Do you think this might be a general way to give posixgroups ACL in ldap? I found in the archives, that many try to do this...
regards
Hansjörg
Pierangelo Masarati schrieb:
Pierangelo Masarati wrote:
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv]) & user" write by * none
You can check if my analysis was correct and, in that case, work your issue around, by adding another layer of dereferencing to constructed DNs, thus forcing them to be normalized according to uid instead of using memberUid's value. The above rule could be modified as
access to dn.sub="cn=Domain Admins,ou=Groups,dc=byn,dc=drv" by set="([uid=] + ([cn=domain admins,ou=groups,dc=byn,dc=drv])/memberUid + [,ou=users,dc=byn,dc=drv])/entryDN & user" write
(remove all line wrapping, of course).
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it
Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati@sys-net.it
openldap-software@openldap.org
-
"Dr. Hansjörg Maurer" -
Pierangelo Masarati