-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
greetings,
I'm trying to configure ACL, I belive it is possible to ... but after some attempts I doubt it is ...
please, help me to understand where I'm making the mistake/s ...
I need to manage possibility for "coadmins" group members to manage all except the objects of "admins" group members
forgive me please my long explanation ...
so I have:
Important: the starting point in my case is auth accounts structure:
users do auth with (lets call it) "root" objects (most upper level): uid=<USER>,ou=People,dc=abc
- ---[ accounts and groups start ]------------------------------------------- dn: uid=admin1,ou=People,dc=abc dn: uid=admin7,ou=People,dc=abc dn: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc
dn: uid=coadmin5,ou=People,dc=abc dn: uid=johndoe,authorizedService=serviceA,uid=coadmin5,ou=People,dc=abc
dn: uid=coadmin6,ou=People,dc=abc
dn: cn=admins,dc=abc memberUid: admin1 - ---[ accounts and groups end ]-------------------------------------------
group objects memberUid attribute value contains uid of the "root" objects
- ---[ group structure start ]------------------------------------------- dn: cn=coadmins,ou=group,dc=abc memberUid: coadmin5 memberUid: coadmin6 - ---[ group structure end ]-------------------------------------------
here is the ACL I managed to work as I want:
- ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]-------------------------------------------
this allows admins to manage passwords of anybody and for all other users manage passwords of self "root" account and service accounts (look structure of account objects above)
and now, I had a hope to do the same to get possibility for coadmins to manage passwords of anybody except admins, and here what I thought about:
- ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set="(([cn=admin,ou=group,dc=abc]/memberUid & this/uid) | ([cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid)) & ([cn=coadmin,ou=group,dc=abc]/memberUid & user/uid)" disclose by set="[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]-------------------------------------------
and it doesn't work
the initial idea of the second `by set=' row is: for coadmins to disallow all access to userPassword if account belongs to admin
am I right to expect:
1.1. "[cn=admin,ou=group,dc=abc]/memberUid & this/uid" is true if uid of current record is member of the group `admin'
when `this' is the very "root" account (uid=admin7,ou=People,dc=abc)
1.2. "[cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid" uid of the "root" account (uid=admin7,ou=People,dc=abc) is admin group member
when `this' is service account like: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc `this/-2' trimms it to `uid=admin7,ou=People,dc=abc' and `/uid' have to provide uid value
1.3. "[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" true if currently loggedin user uid is coadmin group member
so ... was I successfull to explain what I want? :)
- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)