Hi,

 

 

I have deployed a new OpenLDAP server (RHEL 7.1 / openldap-2.4) and have read Matt Butcher’s ‘Mastering …’ book and the OpenLDAP-Admin-Guide but I’m continuing to struggle to find the information I need to satisfactorily configure using the dynamic way of working instead of using the legacy slapd.conf method.  (Any reference to administering ldap using dynamic method would be appreciated)

 

I have OpenLDAP basically configured to answer queries using the Manager object, but I want to remove current privileges and have just two accounts in the system ou – one with read only to the users ou and all objects therein, and one with the equivalent of Manager rights to the users OU that I can give to my devs to create their own users.

 

I would retain the Manager account for full access, but would just like to give out the readonly and readwrite accounts in system OU permissions to users OU, and remove users permissions to anything but themselves.

My intention is to delete the existing olcAccess rules and implement a new set, but I can’t get rid of the old rules as it’s not letting me.

 

 

When I try ‘ldapmodify -x -W -H "ldap://HOSTNAME" -D "cn=Manager,dc=SUBDOMAIN,dc=DOMAIN,dc=TLD" -f acl_delete_file.ldif’        I receive :-

‘modifying entry "olcDatabase={2}hdb,cn=config"

ldap_modify: Insufficient access (50)’

 

 

The delete ldif looks like this :-

 

# {2}hdb, config

dn: olcDatabase={2}hdb,cn=config

delete: olcAccess

 

I am using the default hdb database.

 

 

I understood ‘Manager’ had full access to everything regardless, can anyone shed any light on why this request would be refused ?

 

 

Gary Spencer
Infrastructure Project Engineer