Hi list members,

I use a  openldap server for the user management of an  proprietary client/server application.

Users are modified person class objects.

Groups are groupOfName objects.

Rights are also groupOfNames.

Users are members of groups and groups are members of rights.

To exemplify my problem:

User: cn=example,ou=users,dc=mydomain

Group: cn=supervisors,ou=groups,dc=mydomain

Right: cn=someRight,ou=rights,dc=mydomain

For instance someRight should give all members of supervisors the right to modify other users.

At the moment the ACL is related to the group.

Access to dn.sub=”ou=users,dc=mydomain”

                By group.exact=”cn=supervisor,ou=groups,dc=mydomain” write

                By self read

To use the rights I’d need an ACL with a  group of group.

Access to dn.sub=”ou=users,dc=mydomain”

                By group.exact=”cn=someRight,ou=rights,dc=mydomain” write

Should allow all members of all groups that are member of someRight to modify users.

Is this possible or is groupOfNames the wrong class to represent group rights?

Thanks in advance!

Jan