Hi Michael,
On 11/04/16 07:31, Michael Ströder wrote:
Tim Watts wrote:
# some entries matching filter access to attrs=userPassword filter=(!(employeeType=Archive)(employeeType=Delete)) by ..some who clauses for setting password by * auth
# all other entries access to attrs=userPassword by * none
The second ACL is important!
OK - I'm going to have to get my head around that :) On a test platform... Am I right in thinking the job of the 2nd ACL is because if employeeType is Archive|Delete, the first ACL will simple fall through - so the second ACL is semantically a "Deny All"?
One other thing - I did not mention, which is retrospect might be important:
I don't let slapd store password hashes - it passes through to Kerberos via saslauthd. So the attribute is of this form:
userPassword: {SASL}someuser@MY.KERB.REALM
I presume that blocking access to userPassword will still cause authentication to fail in this case as it won't be able to do that lookup?
Current ACLs are fairly simple:
access to dn.base="" by * read
access to attrs=userPassword by peername.path="/var/run/slapd/ldapi" manage
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^This is somewhat dangerous because it gives any process which has write access to the LDAPI socket *manage* rights. I'd recommend not to do that. Rather use authz-regexp mappings to explicitly map certain OS accounts to real LDAP entries.
I thought you'd say that :) I'm OK with limiting access to the parent directory (in this case to the slapd user and root). For me, it feels simpler. You may disagree, but I just wanted to say it wasn't an oversight.
by set="user/uid &[cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk]/memberUid" manage
Set-ACLs are slow. I'd recommend to use groupOfNames entries to achieve this.
OK - I will have to study that - thanks for pointing it out.
Off to clone a test server off the production one....
I could have done with getting a bit more of this right the first time, but it was sadly a rush job at the time. Now seems like a good time to put some polish on it.
All that best!
Tim