Re: ACL construction : by group

On Thu, Oct 8, 2009 at 12:06, Florian Götz f.goetz@hs-mannheim.de wrote:

access to dn.subtree="ou=Groups,dc=example,dc=de"        by group="cn=Domain Admins,ou=groups,dc=example,dc=de" write

The "by group" ACL requires the members to be DNs.

Is there a possibility to use the existing "Domain Admins" group for user authentication, even if there are only memberUids stored and not complete dn?

You can use sets, at the expense of some performance (I don't know how large of a performance penalty, though). See the examples of the admin guide:

http://www.openldap.org/doc/admin24/access-control.html#Group%20ACLs%20witho...