--On Tuesday, September 12, 2017 1:38 PM -0700 Ryan Tandy ryan@nardis.ca wrote:
On Mon, Sep 11, 2017 at 04:18:20PM -0500, Nick Gray wrote:
With this config,.shouldn't this work as well
ldapsearch -x -W -D cn=Manager,dc=local,dc=bob,dc=com -b cn=config olcDatabase=*
The rules on your config database are:
olcAccess: {0} to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage olcAccess: {1} to * by dn="cn=Manager,dc=local,dc=bob,dc=com" manage
The first matches everything (*), so the second is never consulted.
Which is specifically noted in the slapd.access(5) man page:
The optional field <control> controls the flow of access rule application. It can have the forms
stop continue break
where stop, the default, means access checking stops in case of match.
So as noted in the man page, ACL processing stops at the first matching access rule.
--Quanah
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com