Hi everyone,<div><br></div><div>I&#39;m facing an ACL problem for a long time, and I got to the point that I&#39;m out of ideas. The problem is related to write in a specific branch of DIT. My DIT has the following hierachy</div>

<div><br></div><div>dc=spi,dc=net</div><div>-&gt; c=cl</div><div>--&gt;ou=users</div><div>---&gt;ou=regular</div><div>---&gt;ou=admin</div><div><br></div><div>The ACL should allow the users under the admin subtree to write in the regular subtree (admin and regular users model).</div>

<div><br></div><div>SO, I have the following ACL includes in slapd.conf:</div><div><br></div><div><div>include         /etc/ldap/acls/acl.conf.default</div><div>include         /etc/ldap/acls/acl.conf</div></div><div><br>

</div><div><br clear="all">The ACL files have the following lines:</div><div><br></div><div>#  /etc/ldap/acls/acl.conf.default</div><div><br></div><div><div># The userPassword by default can be changed</div><div># by the entry owning it if they are authenticated.</div>

<div># Others should not be able to see it, except the</div><div># admin entry below</div><div># These access lines apply to database #1 only</div><div>access to attrs=userPassword,shadowLastChange</div><div>        by dn=&quot;cn=admin,dc=spi,dc=net&quot; write</div>

<div>        by anonymous auth</div><div>        by self write</div><div>        by * none</div><div><br></div><div># Ensure read access to the base for things like</div><div># supportedSASLMechanisms.  Without this you may</div>

<div># have problems with SASL not knowing what</div><div># mechanisms are available and the like.</div><div># Note that this is covered by the &#39;access to *&#39;</div><div># ACL below too but if you change that as people</div>

<div># are wont to do you&#39;ll still need this if you</div><div># want SASL (and possible other things) to work </div><div># happily.</div><div>access to dn.base=&quot;&quot; by * read</div><div><br></div><div># The admin dn has full write access, everyone else</div>

<div># can read everything.</div><div>access to *</div><div>        by dn=&quot;cn=admin,dc=spi,dc=net&quot; write</div><div>        by * read</div></div><div><br></div><div><div>#  /etc/ldap/acls/acl.conf</div></div><div>

<br></div><div><div>access to dn.children=&quot;ou=regular,ou=users,c=cl,dc=spi,dc=net&quot;</div><div>        attrs=&quot;children&quot;</div><div>        by dn.sub=&quot;ou=admins,ou=users,c=cl,dc=spi,dc=net&quot; manage</div>

<div>        by * read</div></div><div><br></div><div><br></div><div>So, I created an user under the admin subtree with the following DN:</div><div><br></div><div>uid=cl-admin,ou=admins,ou=users,c=cl,dc=spi,dc=net</div><div>

<br></div><div>To test, I&#39;m trying to add an user with the following LDIF file:</div><div><br></div><div><div># Teste</div><div>description: Test</div><div>dn: uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net</div><div>

objectClass: person</div><div>objectClass: organizationalPerson</div><div>objectClass: inetOrgPerson</div><div>objectClass: spi # Customized class</div><div>cn: Teste</div><div>sn: teste</div><div>givenName: Teste</div><div>

uid: teste</div><div>url: <a href="http://mysite.com">http://mysite.com</a></div><div>mail: <a href="mailto:test@mysite.com">test@mysite.com</a></div><div>l: City</div><div>TimeZone: GMT-4</div><div>area: Gov</div><div>st: State</div>

<div>organization: Organization</div><div>o: SPI</div><div>preferredLanguage: en-US</div></div><div><br></div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div><br></div><div>However, when I try to add the user (ldapadd -x -D &quot;uid=cl-admin,ou=admins,ou=usuarios,c=cl,dc=spi,dc=net&quot; -W -f /tmp/test.ldif</div>

<div><br></div><div>I get the following error:</div><div><br></div><div><div>ldap_add: Insufficient access (50)</div><div>        additional info: no write access to parent</div></div><div><br></div><div><br></div><div>The debug output log for ACL&#39;s show me the following sequence of information:</div>

<div><br></div><div><br></div><div><div>Nov  3 12:00:47 nodo108 slapd[16629]: hdb_referrals: tag=104 target=&quot;uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net&quot; matched=&quot;ou=regular,ou=users,c=cl,dc=spi,dc=net&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: ==&gt; hdb_add: uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_required entry (uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net), objectClass &quot;spi&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;objectClass&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;cn&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;sn&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;givenName&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;uid&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;url&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;mail&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;l&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;timeZone&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;area&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;st&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;organization&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;o&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;preferredLanguage&quot;</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: oc_check_allowed type &quot;structuralObjectClass&quot;</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: slap_queue_csn: queing 0xb6603a32 20101103140047.629760Z#000000#000#000000</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: bdb_dn2entry(&quot;uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net&quot;)</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; hdb_dn2id(&quot;uid=test,ou=regular,ou=users,c=cl,dc=spi,dc=net&quot;)</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: &lt;= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990)</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; access_allowed: add access to &quot;ou=regular,ou=users,c=cl,dc=spi,dc=net&quot; &quot;children&quot; requested</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; dn: [1] ou=regular,ou=users,c=cl,dc=spi,dc=net</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; dn: [3] </div><div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; acl_get: [4] attr children</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; acl_mask: access to entry &quot;ou=regular,ou=users,c=cl,dc=spi,dc=net&quot;, attr &quot;children&quot; requested</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; acl_mask: to all values by &quot;uid=cl-admin,ou=admins,ou=users,c=cl,dc=spi,dc=net&quot;, (=0) </div><div>Nov  3 12:00:47 nodo108 slapd[16629]: &lt;= check a_dn_pat: cn=admin,dc=spi,dc=net</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: &lt;= check a_dn_pat: *</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: &lt;= acl_mask: [2] applying read(=rscxd) (stop)</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: &lt;= acl_mask: [2] mask: read(=rscxd)</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; slap_access_allowed: add access denied by read(=rscxd)</div></div><div><div>Nov  3 12:00:47 nodo108 slapd[16629]: =&gt; access_allowed: no more rules</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: hdb_add: no write access to parent</div>

<div>Nov  3 12:00:47 nodo108 slapd[16629]: send_ldap_result: conn=26 op=1 p=3</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: send_ldap_result: err=50 matched=&quot;&quot; text=&quot;no write access to parent&quot;</div>
<div>
Nov  3 12:00:47 nodo108 slapd[16629]: send_ldap_response: msgid=2 tag=105 err=50</div><div>Nov  3 12:00:47 nodo108 slapd[16629]: conn=26 op=1 RESULT tag=105 err=50 text=no write access to parent</div></div><div><br></div>

<div><br></div><div>I tried a lot of different solutions, but nothing seels to work. Anybody have a clue about how to fix it?</div><div><br>-- <br>Eduardo Santos<br>Analista de Sistemas<br><br><a href="http://eduardosan.wordpress.com">http://eduardosan.wordpress.com</a><br>

<a href="http://twitter.com/eduardosan">http://twitter.com/eduardosan</a><br>
</div>