Hi @all,

 

I’ve tried to implement a olcAccess via regex for multiple directory entries.

The goal was to group different users in two standard groups. Each group does have other access rules. I didn’t what to do such a thing for every entry, so I thought that I’m able to do that with regexes.

But my olcAccess rules doesn’t work.

 

I’ve already posted the question to stackoverflow, but no answers till now. Here the link:

http://stackoverflow.com/questions/31693040/ldap-olcaccess-regex-are-not-working-as-expected

 

And here the rule for a regex access:

 

olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$"

  attrs=children

  by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write

  by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read

  by * none

 

Does somebody can help me? Or is such a thing not possible to do?

 

Greetings

John

 

PS: the content from Stackoverflow:

----------------------------------------------------------------------------------------

I have a LDAP server runnign with the Structure:

dc=example,dc=ldap
   dc=organisations
      o=orga1 (objectClasses top/organisation/dcObject)
         cn=ADMINS (objectClasses top/groupOfNames)
         cn=USER
      o=orga2 
         cn=ADMIN
         cn=USER
      cn=users (objectClasses top/organisation/dcObject)
         cn=user1 (objectClasses top/person)
         cn=user2

Now I whant to add some rules that only the users in the organisation groups are able to see the organisation.

the hard coded approach was quite easy to implement:

olcAccess: {1}to dn.subtree="o=orga1,dc=organizations,dc=example,dc=ldap"
  by group.exact="cn=ADMINS,o=orga1,dc=organizations,dc=example,dc=ldap" write
  by group.exact="cn=USER,o=orga1,dc=organizations,dc=example,dc=ldap" read
  by * none

(It is important to write TWO spaces in front of the 'by' [It was an problem for a long time for me])

But I don't whant to implement these rules for every new organisation, so I tried to implement the rule with some regex magig. But I failed misserably:

olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$"
  attrs=children
  by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write
  by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read
  by * none

This rule affects nothing. So does someone have some idea to fix my problematic?

Or is it not possible to group the members like I did?

Thanks again

 

 

--

Johannes Fischer

Research Fellow

Fraunhofer Institute for

Manufacturing Engineering and Automation IPA

 

Competence Centre Digital Tools for Manufactoring

 

Nobelstrasse 12 70569 Stuttgart  |  Germany

Phone +49 711 970-1217

 

Johannes.Fischer@ipa.fraunhofer.de

www.ipa.fraunhofer.de