I did read, but slapd does it the wrong way. My slapd.conf does contain following:
# forbid writing to userPassword for entries starting with {SASL} access to attrs=userPassword val.regex="SASL}.*" by * auth stop
# allow writing to ldapclient and self, otherwise only auth access to attrs=userPassword,userPKCS12,sambaNTPassword,sambaLMPassword by dn="cn=ldapclient,dc=mydomain,dc=de" write by self write by * auth
What I expect is that an entry with an existing userPasswd of '{SASL}something' will not be writable by any user.
What I get is that the ldapclient and 'self' can write new userPasword if the content of the *NEW* password does not contain {SASL}.
I don't understand how to get it working in my way.
Protocol: ---------
Database has following entries (shortened):
dn: uid=frust,ou=People,dc=mydomain,dc=de userPassword:: geheim
dn: uid=someone,ou=People,dc=mydomain,dc=de userPassword:: {SASL}someone
Now try to change entries:
ldapmodify -x -v -D 'cn=ldapclient,dc=mydomain,dc=de' -W dn: uid=someone,ou=People,dc=mydomain,dc=de changetype: modify replace: userPassword userPassword: newpass -
Enter LDAP Password: replace userPassword: newpass modifying entry "uid=someone,ou=People,dc=mydomain,dc=de" modify complete
ldapmodify -x -v -D 'cn=ldapclient,dc=mydomain,dc=de' -W dn: uid=frust,ou=People,dc=mydomain,dc=de changetype: modify replace: userPassword userPassword: {SASL}abc -
Enter LDAP Password: replace userPassword: {SASL}abc modifying entry "uid=frust,ou=People,dc=mydomain,dc=de" ldap_modify: Insufficient access (50)
Am Freitag, den 26.11.2010, 05:09 -0800 schrieb Howard Chu:
Frank Rust wrote:
Hi all,
would it be possible to configure a content-based access control?
Yes. Read the slapd.access(5) manpage.
I have following configuration: my ldap contains user data. Some of the users are local ones and have a regular password entry. They shall be able to change their password. Other users are remotely authenticated with saslauthd. They shall not be able to change their 'password' which is just a redirection.