Am Montag 04 Mai 2009 10:32:42 schrieb Florian Götz:
as I was trying to implement your ACL a more fundamental problem arose.
The structure at the moment is
-> ou= Users
-> Some users in here with their data
If I do a ldapsearch with the admin DN I can get all the data from
everything I want. The way it should be.
ldapsearch -xWD cn=admin,dc=justushere,dc=de uid=goetzf
gives me all the information about my own user.
If I try
ldapsearch -xWD uid=goetzf,ou=Users,dc=justushere,dc=de uid=goetzf
I get "ldap_bind: Invalid credentials (49)" as answer.
The only ACL left in the system now are the following:
#1 .Publishing subschemas for JXplorer
access to dn.base="cn=Subschema"
by dn="cn=admin,dc=justushere,dc=de" read
#2. Your ACL, now commented out for testing
#access to dn.regex="^uid=([^,]+),dc=justushere,dc=de$"
# by dn.exact,expand="uid=$1,ou=Users,dc=justushere,dc=de" write
# by * none
#3. Deny any other access
access to *
I got no clue why I get a "invalid credential" message when using my own
password. There are no ACLs restricting access. No matter if I you your ACL
above or not, I´m not getting access with my password.
If I just use ACL Nr 1 and another
access to * by self read
I can´t get any info as well, no matter if i use
ldapsearch -xWD uid=goetzf,ou=Users,dc=justushere,dc=de uid=goetzf or even
ldapsearch -xWD uid=goetzf,ou=Users,dc=justushere,dc=de
If I rewrite that to
access to * by * read
I get all information with my password.
As I mentioned above, I got no more clues how to handle that :(
In order to be able
to authenticate using simple bind, you need to have "auth"
privileges on the "userPassword" attribute. As none of your ACLs grants that
right, your ldapsearch -x.... currently fails with "ldap_bind: Invalid
Please try to add the following ACL as the first in your list:
access to attr=userpassword
by self =xw
by anonymous auth
Addtionally you should have a look at:
and the admin guide for more information.