Hi! I'm currently using the rwm overlay to filter the objects from my ou=students,dc=uni-bamberg,dc=de directory by their "o"-attribute and project the result to ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de Therefore I use the following section within my slapd.conf (before the "database hdb..." section):

database relay suffix "ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" overlay rwm #rwm-rewriteEngine on rwm-suffixmassage "ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" "ou=students,dc=uni-bamberg,dc=de" rwm-rewriteContext bindDN rwm-rewriteRule ".*" "cn=ldapadmin,dc=uni-bamberg,dc=de" ":@" rwm-rewriteContext searchFilter rwm-rewriteRule "(.*)" "(&(o=swt)$1)" ":@I"

searchFilter rewriting works perfectly but I also need to rewrite the bindDN as every operation within ou=students,dc=uni-bamberg,dc=de needs to be carried out by a particular user (cn=ldapadmin,dc=uni-bamberg,dc=de) (the reason is that i don't want any user other than ldapadmin to be able to write ou=students,dc=uni-bamberg,dc=de but they should be able to modifiy entries from ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de) according to the logs and the error reply messages there seems to be no binndn rewriting done... It looks like the rule never matches. Is my rule not general enough to match each possible bindDN-String? Is "cn=ldapadmin,dc=uni-bamberg,dc=de" (replacement string for the bindDN) not well formatted (does it expect something else)? Does the overlay "relay" prevent the replacement of the bindDN?

The code is working as intended, and the rule is general enough; using verbatim the configuration you provided, if I run

ldapwhoami -x -H ldap://:9011 \ -D 'cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de' \ -w password

I get

conn=1000 op=0 BIND dn="cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" method=128 do_bind: version=3 dn="cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" method=128 ==> rewrite_context_apply [depth=1] string='cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de' ==> rewrite_rule_apply rule='.*' string='cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'cn=ldapadmin,dc=uni-bamberg,dc=de'} [rw] bindDN: "cn=Someone,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" -> "cn=ldapadmin,dc=uni-bamberg,dc=de"

...

...

dnPrettyNormal: <cn=ldapadmin,dc=uni-bamberg,dc=de>

=> ldap_bv2dn(cn=ldapadmin,dc=uni-bamberg,dc=de,0) <= ldap_bv2dn(cn=ldapadmin,dc=uni-bamberg,dc=de)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=uni-bamberg,dc=de)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=uni-bamberg,dc=de)=0 <<< dnPrettyNormal: <cn=ldapadmin,dc=uni-bamberg,dc=de>, <cn=ldapadmin,dc=uni-bamberg,dc=de>

^^^ the mapping occurred as expected.

The bind fails because no database can handle that DN, which I suspect is also your case. What's problematic in your design is that although the DN is rewritten, the credentials remain those of the user that's actually binding, so the bind will always fail. Is this what you expect?

p.

Any help appreciated!

-- Lehrstuhl für Softwaretechnik und Programmiersprachen Fakultät WIAI, Universität Bamberg, 96045 Bamberg

Email: thomas.wunder@swt-bamberg.de Web: http://www.swt-bamberg.de/ Tel.: 0951 863-3852 / Fax: 0951 863-3855

Please reply to the address I'm using. I assume you didn't read my "vacation" message, then.

Then it seems that I've misinterpret the way bindDN rewriting works.

I actually thought that it would be possible that an operation on an object within the rewritten subtree (ou=students,ou=people,ou=swt,ou=wiai,dc=uni- bamberg,dc=de) which is started by a user (cn=smbldapadmin,dc=uni- bamberg,dc=de (who is not within the subtree which is rewritten)) could be internally carried out with the privileges of a different user (cn=ldapadmin,dc=uni-bamberg,dc=de).

To make it a bit clearer this are the Users/Objects involved...: UsrA: cn=smbldapadmin,dc=uni-bamberg,dc=de Obj : cn=A,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de UsrB: cn=ldapadmin,dc=uni-bamberg,dc=de Obj' : cn=A,ou=students,dc=uni-bamberg,dc=de

...and this is what i want my LDAP-Server to do:

1. UsrA -> bind to LDAP-Service
2. Add Obj (as UsrA) --- internal rewriting ---> Add Obj' (as UsrB)
3. process "Add Obj' " internally
4. --> if successful "Obj" should be visible to UsrA

Would it be possible to achieve this with the rwm/relay overlay or is there another overlay that could do that for me?

What you're looking for is authorization. You want any user "cn=A,ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de" to authorize as "cn=ldapadmin,dc=uni-bamberg,dc=de". You should then use proxyAuthz (RFC4370).

You need to add

authz-policy from

then, in "cn=ldapadmin,dc=uni-bamberg,dc=de", you need to add the attribute

authzFrom: dn.onelevel:ou=students,ou=people,ou=swt,ou=wiai,dc=uni-bamberg,dc=de

an your clients need to use the proxyAuthz control; for example

ldapsearch -e '!authzid=dn:cn=ldapadmin,dc=uni-bamberg,dc=de'

Currently, there's no overlay that can do this for you. You could obtain something like this using slapd-ldap (possibly with slapo-rwm), by means of the idassert feature. This would allow to authorize selected users as the "cn=ldapadmin,dc=uni-bamberg,dc=de" identity, subjected to authorization privileges by the remote DSA.

p.