Addendum :
Ldap is up and running with my configuration :
[root@ldap2]# ps auxwww | grep slapd ldap 17190 0.0 1.1 426480 44384 ? Ssl Nov14 0:05 /usr/sbin/slapd -h ldap:/// -u ldap
And the directory sounds to respond exactly as I wish to usual queries.
However, here is a slapcat output :
[root@ldap2]/usr/sbin/slapcat -F /etc/openldap/slapd.d -l ldap-conf.ldif
PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. olcSyncrepl: value #0: rootDN must be defined before syncrepl may be used config error processing olcDatabase={1}bdb,cn=config: rootDN must be defined before syncrepl may be used slapcat: bad configuration directory!
I checked and that's true that the synchronisation doesn't work properly anymore.
I had to reinserted this to have everything working well :
dn: olcDatabase={1}bdb,cn=config OlcrootDN cn=Manager,dc=example,dc=fr
( no need for OlcrootPW)
-- Olivier
On Mon, Nov 14, 2011 at 5:15 PM, Olivier Guillard olivier@guillard.nom.fr wrote:
Hi there,
I would like to have your feeling or advices about the following acl strategy for ldap administration issues (cn=config and actual directory administration). I have tested that and it sounds to work properly :
My idea is to create two groups of people : one for those that administrates accounts in the directory, and another for those that are able to tune "cn=config"
Basically, I have the following DIT : cn=config and dn: dc=example,dc=fr
I have then created two "groupOfnames" (admin-ldap and admin-dir) and tuned ACL so that : directory admins can modify accounts and ldap admins can modify "slapd.d"
I also have removed RootDN as well as RootPW both in : olcDatabase={0}config,cn=config as well as in olcDatabase={1}bdb,cn=config
so that maintenance operation are not performed as "RootDN" anymore.
ANY REACTIONS OR ADVICES ON THAT ?
HARE IS HOW I HAVE TUNED THAT :
# Entries for the two groupofnames :
dn: cn=admin-dir,ou=system,dc=example,dc=fr cn: admin-dir member: uid=guillard,ou=people,dc=example,dc=fr member: uid=foo,ou=people,dc=example,dc=fr member: uid=shmol,ou=people,dc=example,dc=fr objectclass: groupOfNames objectclass: top
dn: cn=admin-ldap,ou=system,dc=example,dc=fr cn: admin-ldap member: uid=guillard,ou=staff,ou=people,dc=example,dc=fr member: uid=pick,ou=staff,ou=people,dc=example,dc=fr objectclass: groupOfNames objectclass: top
### ACL :
dn: olcDatabase={0}config,cn=config objectclass: olcDatabaseConfig olcaccess: {0}to * by group.exact="cn=admin-ldap,ou=system,dc=example ,dc=fr" write by * none ...
### And :
dn: olcDatabase={1}bdb,cn=config objectclass: olcDatabaseConfig objectclass: olcBdbConfig ... olcaccess: {0}to dn.base="dc=example,dc=fr" by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read by dn.base="cn=replication,ou=system,dc=example,dc=fr" read by * search olcaccess: {1}to dn.one="dc=example,dc=fr" by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by users search by anonymous auth
### then : olcaccess: {2}to dn.subtree="ou=system,dc=example,dc=fr" by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by * none
### and : olcaccess: {3}to dn.subtree="dc=example,dc=fr" attrs=userPassword,shadowLastChange,loginShell by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" write by self write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by users auth by anonymous auth
### finally : olcaccess: {4}to dn.subtree="dc=example,dc=fr" by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by users read by anonymous read