openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: allow admin group to write excluding specific users
by Gavin Henry 14 Aug '08

14 Aug '08

----- "Stelios A." <stelios.a(a)gmail.com> wrote: > No, i have seperated Groups like: > > dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr > cn: IT > objectClass: groupOfUniqueNames > uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com > uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com > > and all users under ou=Users,dc=mydomain,dc=edu,dc=com OK, just grant one group write and not the other. Remember, ACLs are accessed from top down. There are plenty of examples on the FAQ: http://www.openldap.org/faq/data/cache/52.html Again, also read the man page. Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: allow admin group to write excluding specific users
by Stelios A. 14 Aug '08

14 Aug '08

No, i have seperated Groups like: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com and all users under ou=Users,dc=mydomain,dc=edu,dc=com Thanks 2008/8/14 Gavin Henry <ghenry(a)openldap.org>: > Stelios A. wrote: >> >> Hello, >> >> I have a group called IT and another one called LDAP Admins. There are >> 5 users under IT and 2 under LDAP Admins. >> I'm looking for an acl where members of IT (groupOfUniqueNames) can >> modify/write anywhere under ou=Users.... apart from those users under >> the LDAP Admins group. >> Can anyone give me a help about this please. >> >> I've found only how to give access to IT group but not how to exclude >> LDAP Admins (2 in total) where those 2 exist also under IT group. >> >> Any ideas? > > Your DIT sounds a bit messy. Do you have groups under ou=Users? > > What is your design? > > BTW, man slapd.access > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > -- Stelios A

1 0

Drupal/OpenLDAP integration
by Jeff Sussna 14 Aug '08

14 Aug '08

Anyone have success integrating Drupal with OpenLDAP via the ldapauth module? I've been thrashing all day. Have read Drupal posts that imply others have thrashed as well. Details of my pain are at http://drupal.org/node/295029 . Thx, Jeff

2 1

Re: Drupal/OpenLDAP integration
by Jeff Sussna 14 Aug '08

14 Aug '08

Never mind. I am a blithering idiot. When I changed user passwords in JXplorer, I clicked OK in the password dialog, but then forgot to click Submit in the main window, so the changes never took effect. Tried againd and did it right this time, and everything works just fine. Good news is that I can attest that integrating Drupal with OpenLDAP is trivial, as long as you have a few brain cells left to spare :-).

1 0

NewBi: Trying to setup a custom project.
by Flip Vernooij 13 Aug '08

13 Aug '08

Hi all, For a project at work I need to setup a LDAP server and make it possible to authenticate allot of (yet unwriten) applications. I have been reading for the past 2 days on the internet about this issue but I have the feeling I do not have enough knowledge to provide a correct setup. The idea is that there are a few different ou¹s holding several users. These users all hold login-profiles for the applications we are developping right now. Alldue this sounds kinda logic, I do not exactly understand how the authentication should take place. Lets say: Dn=domain,dn=com ou=test -user name=me pass=secret --app_1 username=appuser password=appSecret ap_related_opt=variable --app_2 username=app2user password=app2secret other_ap_related_opt=variable --app_3 username=app3user password=app3secret other_ap_related_opt=variable -user /// Next user holding the same structure. Now I wrote a master_app that should handle the authentication using LDAP. It received the ³me² username with corresponding password and must fetch a list of profiles used for the requested applications (say app_1 and app_2) I¹m still in doubt about the app username and password, as without a matching profile, application access would be denied anyways so I could store some acl values to (is that right?) Am I on the right track here, any ideas sugestions links or examples? Thanks for reading! Flip Vernooij

1 0

allow admin group to write excluding specific users
by Stelios A. 13 Aug '08

13 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT. Thanks

1 0

Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 13 Aug '08

13 Aug '08

Rahul, My friend finally a response. Thank you for the input I had also read that link you provided, it was somewhat helpful. If the usernames were identical that would work great I believe. However the source name is coming in as joe_montana and I need it to map to jmontana. So I need only the first character of the first name and everything after the underscore (last name). I am looking for the expression that would give me that. I am not too familiar with the expressions syntax or how to manipulate them. I see there is an option to search ldap using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I should look into that. Do you have any suggestions or source for reading on authz-regexp? I have been looking. If it was shell scripting I could manage another way. When you say the SASL Realm would that go in the main slapd.conf or the /usr/lib/sasl2/slapd.conf? I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting close,just gotta get past this. :) Thank you again. James ------------------------------ Message: 2 Date: Mon, 11 Aug 2008 17:54:02 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Help with authz-regexp mapping kerberos identity to dn ....SASL To: openldap-technical(a)openldap.org Message-ID: <48A02F62.1000305(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, This is the authz-regexp string I have used in slapd.conf: authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com This works if the SASL auth mechanism is gssapi. I have also hard-coded the SASL Realm with the below config option: sasl-realm SYNOVEL.COM If it uses the default realm (i.e. sasl-realm option is missing) then the string would probably be: authz-regexp uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com Hope this is of some assistance. For furthur information, kindly read http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication%2 0Identities . Regards, Rahul. Chavez, James R. wrote: > Hello all, > My plan is to use Kerberos and LDAP as a replacement for NIS. > My issue is that I need my kerberos credentials to map to a user in LDAP > so I can avoid permission issues when logging in with kerberos creds. > All the perms are based on the UNIX/LDAP users and groups. Thing is the > user id's are different between kerberos and LDAP. > The kerberos names consist of firstname_lastname@REALM. The ldap entries > are in the format of standard Unix user names or first letter of first > name and up to 7 characters of the last name (jmontana). I migrated the > LDAP entries from my existing NIS maps. > Now I understand that I can use SASL and authz-regexp in slapd.conf to > map these id's. Please correct me if I am wrong. > > I added all the corresponding "krbName: first_last@REALM" to the users > when I added them to the LDAP directory. > For example for user Joe Montana..His ldap dn is "dn: > uid=jmontana,ou=People,dc=test,dc=example,dc=com" > His uid is "uid: jmontana > And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" > > I think all the data is there to get a mapping I just am unsure of the > auth-regexp strings I need to add to the slapd.conf file. > Does anyone out there have any experience with this and better yet > provide the string or example of what strings I can use? > I have searched the net on how to authenticate with kerberos and > effictively login with a local id but have been unsuccessful in my > search. > Appreciate any help. > > Thank You > James > > CONFIDENTIALITY > This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. > ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity. > > CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

implicit context attribute in add request
by Wolfgang Bergbauer 12 Aug '08

12 Aug '08

Hi all, I have a problem with the standard JNDI LDAP bind request and wanted to know if OpenLdap behaves differently: e.g. when creating and object with a LDAP addRequest with a context of umObjectGUID=0, OU=People, DC=avaya then I will automatically get a attribute: umObjectGUID with value "0". So this is implicit, I do not specify this attribute. Unfortunately the ldap server then responds that this attribute is readOnly. Can anyone tell me if OpenLdap also add this implicit context attribute, or perhaps what other options do I have here? Thanks a lot, Wolfgang

1 0

ACL's for admin users
by Aravind Arjunan 12 Aug '08

12 Aug '08

hi, In my openldap i created a OU called india under this ou there are many users and one administrator as admin. I want this admin user to add and modify the users details only in this ou. for that i need to set the access control list. Can any one plz help me how to set acl's for this case. Remaining users have only read only permissions. eg: ou=india cn=admin---administrator cn=sachin cn=rahul cn=saurav cn=anil

2 1

allow admin group to write excluding specific users
by Stelios A. 12 Aug '08

12 Aug '08

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical