From nata.cs2@gmail.com Fri Feb 11 12:56:19 2011
From: Natalia <nata.cs2@gmail.com>
To: openldap-technical@openldap.org
Subject: ACL peername
Date: Fri, 11 Feb 2011 13:55:29 +0100
Message-ID: <AANLkTim-bX=M1Mk0AhFDWnY6spdw5+U0RmBfSiBSQ03u@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8271335526828634470=="

--===============8271335526828634470==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Hi,

i have a problem with ACLs. I will to grant access to IP. my ACL:

olcAccess: to dn.subtree="ou=people,dc=example,dc=de"
 by group.exact="cn=lda,ou=Endsysteme,dc=example,dc=de" write
 by group.exact="cn=kon,ou=Endsysteme,dc=example,dc=de" read
 by peername.ip=127.0.0.1 read
 by * none

But i become error:

ldap_modify: Other (e.g., implementation specific) error (80)
        additional info: <olcAccess> handler exited with 1

in logs:

 conn=1034 op=4 MOD attr=olcAccess olcAccess
Feb 11 13:33:07 ldap slapd2.4[21279]: slapd: line 0: expecting <access> got
"writeby".
Feb 11 13:33:07 ldap slapd2.4[21279]: <access clause> ::= access to <what> [
by <who> [ <access> ] [ <control> ] ]+  <what> ::= * | dn[.<dnstyle>=<DN>]
[filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname>
[val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::=
<attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> |
!<objectClass> | entry | children <who> ::= [ * | anonymous | users | self |
dn[.<dnstyle>]=<DN> ]     [ realanonymous | realusers | realself |
realdn[.<dnstyle>]=<DN> ]      [dnattr=<attrname>]
[realdnattr=<attrname>]
[group[/<objectclass>[/<attrname>]][.<style>]=<group>]
[peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>]
[domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>]
[dynacl/<name>[/<options>][.<dynstyle>][=<pattern>]]    [ssf=<n>]
[transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex |
base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children
| exact | regex <attrstyle> ::= exact | regex | base(Obj
Feb 11 13:33:07 ldap slapd2.4[21279]: conn=1034 op=4 RESULT tag=103 err=80
text=<olcAccess> handler exited with 1

I have OpenLDAP 2.4.22. If i remove "by peername.ip=127.0.0.1 read" it
works.

Thanks for help!

Kind regards
Natalia



--===============8271335526828634470==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.htm"
MIME-Version: 1.0

SGksPGJyPjxicj5pIGhhdmUgYSBwcm9ibGVtIHdpdGggQUNMcy4gSSB3aWxsIHRvIGdyYW50IGFj
Y2VzcyB0byBJUC4gbXkgQUNMOjxicj48YnI+b2xjQWNjZXNzOiB0byBkbi5zdWJ0cmVlPSZxdW90
O291PXBlb3BsZSxkYz1leGFtcGxlLGRjPWRlJnF1b3Q7IDxicj6gYnkgZ3JvdXAuZXhhY3Q9JnF1
b3Q7Y249bGRhLG91PUVuZHN5c3RlbWUsZGM9ZXhhbXBsZSxkYz1kZSZxdW90OyB3cml0ZTxicj4K
oGJ5IGdyb3VwLmV4YWN0PSZxdW90O2NuPWtvbixvdT1FbmRzeXN0ZW1lLGRjPWV4YW1wbGUsZGM9
ZGUmcXVvdDsgcmVhZDxicj6gYnkgcGVlcm5hbWUuaXA9MTI3LjAuMC4xIHJlYWQ8YnI+oGJ5ICog
bm9uZTxicj48YnI+QnV0IGkgYmVjb21lIGVycm9yOjxicj48YnI+bGRhcF9tb2RpZnk6IE90aGVy
IChlLmcuLCBpbXBsZW1lbnRhdGlvbiBzcGVjaWZpYykgZXJyb3IgKDgwKTxicj6goKCgoKCgIGFk
ZGl0aW9uYWwgaW5mbzogJmx0O29sY0FjY2VzcyZndDsgaGFuZGxlciBleGl0ZWQgd2l0aCAxPGJy
Pgo8YnI+aW4gbG9nczo8YnI+PGJyPqBjb25uPTEwMzQgb3A9NCBNT0QgYXR0cj1vbGNBY2Nlc3Mg
b2xjQWNjZXNzPGJyPkZlYiAxMSAxMzozMzowNyBsZGFwIHNsYXBkMi40WzIxMjc5XTogc2xhcGQ6
IGxpbmUgMDogZXhwZWN0aW5nICZsdDthY2Nlc3MmZ3Q7IGdvdCAmcXVvdDt3cml0ZWJ5JnF1b3Q7
Ljxicj5GZWIgMTEgMTM6MzM6MDcgbGRhcCBzbGFwZDIuNFsyMTI3OV06ICZsdDthY2Nlc3MgY2xh
dXNlJmd0OyA6Oj0gYWNjZXNzIHRvICZsdDt3aGF0Jmd0OyBbIGJ5ICZsdDt3aG8mZ3Q7IFsgJmx0
O2FjY2VzcyZndDsgXSBbICZsdDtjb250cm9sJmd0OyBdIF0roCAmbHQ7d2hhdCZndDsgOjo9ICog
fCBkblsuJmx0O2Ruc3R5bGUmZ3Q7PSZsdDtETiZndDtdIFtmaWx0ZXI9Jmx0O2ZpbHRlciZndDtd
IFthdHRycz0mbHQ7YXR0cnNwZWMmZ3Q7XSAmbHQ7YXR0cnNwZWMmZ3Q7IDo6PSAmbHQ7YXR0cm5h
bWUmZ3Q7IFt2YWxbLyZsdDttYXRjaGluZ1J1bGUmZ3Q7XVsuJmx0O2F0dHJzdHlsZSZndDtdPSZs
dDt2YWx1ZSZndDtdIHwgJmx0O2F0dHJsaXN0Jmd0OyAmbHQ7YXR0cmxpc3QmZ3Q7IDo6PSAmbHQ7
YXR0ciZndDsgWyAsICZsdDthdHRybGlzdCZndDsgXSAmbHQ7YXR0ciZndDsgOjo9ICZsdDthdHRy
bmFtZSZndDsgfCBAJmx0O29iamVjdENsYXNzJmd0OyB8ICEmbHQ7b2JqZWN0Q2xhc3MmZ3Q7IHwg
ZW50cnkgfCBjaGlsZHJlbiAmbHQ7d2hvJmd0OyA6Oj0gWyAqIHwgYW5vbnltb3VzIHwgdXNlcnMg
fCBzZWxmIHwgZG5bLiZsdDtkbnN0eWxlJmd0O109Jmx0O0ROJmd0OyBdoKCgoCBbIHJlYWxhbm9u
eW1vdXMgfCByZWFsdXNlcnMgfCByZWFsc2VsZiB8IHJlYWxkblsuJmx0O2Ruc3R5bGUmZ3Q7XT0m
bHQ7RE4mZ3Q7IF2goKCgoCBbZG5hdHRyPSZsdDthdHRybmFtZSZndDtdoKCgoCBbcmVhbGRuYXR0
cj0mbHQ7YXR0cm5hbWUmZ3Q7XaCgoKCgoKCgIFtncm91cFsvJmx0O29iamVjdGNsYXNzJmd0O1sv
Jmx0O2F0dHJuYW1lJmd0O11dWy4mbHQ7c3R5bGUmZ3Q7XT0mbHQ7Z3JvdXAmZ3Q7XaAgW3BlZXJu
YW1lWy4mbHQ7cGVlcm5hbWVzdHlsZSZndDtdPSZsdDtwZWVyJmd0O10gW3NvY2tuYW1lWy4mbHQ7
c3R5bGUmZ3Q7XT0mbHQ7bmFtZSZndDtdoKCgoKCgoKAgW2RvbWFpblsuJmx0O2RvbWFpbnN0eWxl
Jmd0O109Jmx0O2RvbWFpbiZndDtdIFtzb2NrdXJsWy4mbHQ7c3R5bGUmZ3Q7XT0mbHQ7dXJsJmd0
O12goKCgIFtkeW5hY2wvJmx0O25hbWUmZ3Q7Wy8mbHQ7b3B0aW9ucyZndDtdWy4mbHQ7ZHluc3R5
bGUmZ3Q7XVs9Jmx0O3BhdHRlcm4mZ3Q7XV2goKAgW3NzZj0mbHQ7biZndDtdIFt0cmFuc3BvcnRf
c3NmPSZsdDtuJmd0O10gW3Rsc19zc2Y9Jmx0O24mZ3Q7XSBbc2FzbF9zc2Y9Jmx0O24mZ3Q7XSAm
bHQ7c3R5bGUmZ3Q7IDo6PSBleGFjdCB8IHJlZ2V4IHwgYmFzZShPYmplY3QpICZsdDtkbnN0eWxl
Jmd0OyA6Oj0gYmFzZShPYmplY3QpIHwgb25lKGxldmVsKSB8IHN1Yih0cmVlKSB8IGNoaWxkcmVu
IHwgZXhhY3QgfCByZWdleCAmbHQ7YXR0cnN0eWxlJmd0OyA6Oj0gZXhhY3QgfCByZWdleCB8IGJh
c2UoT2JqPGJyPgpGZWIgMTEgMTM6MzM6MDcgbGRhcCBzbGFwZDIuNFsyMTI3OV06IGNvbm49MTAz
NCBvcD00IFJFU1VMVCB0YWc9MTAzIGVycj04MCB0ZXh0PSZsdDtvbGNBY2Nlc3MmZ3Q7IGhhbmRs
ZXIgZXhpdGVkIHdpdGggMTxicj48YnI+SSBoYXZlIE9wZW5MREFQIDIuNC4yMi4gSWYgaSByZW1v
dmUgJnF1b3Q7YnkgcGVlcm5hbWUuaXA9MTI3LjAuMC4xIHJlYWQmcXVvdDsgaXQgd29ya3MuPGJy
Pjxicj4KVGhhbmtzIGZvciBoZWxwITxicj48YnI+S2luZCByZWdhcmRzPGJyPk5hdGFsaWE8YnI+
PGJyPgo=

--===============8271335526828634470==--