Am Thu, 6 Sep 2012 13:35:56 +0200 schrieb Denny Schierz linuxmail@4lin.net:
hi,
I have the following structure:
cn=foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar1,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar2,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo
cn=foobar likes like:
dn: foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo objectClass: inetLocalMailRecipient objectClass: person objectClass: top cn: admin sn: admin description: added_by_dekanat mailLocalAddress: sysop@department.domain.foo mailRoutingAddress: foobar@department.domain.foo
At the moment I have one role "mail" that has access to:
dn.sub="ou=mail,ou=services,ou=department,dc=domain,dc=foo" read
it works as expected, the mailserver can read all entries.
Now I want to create a role, who has permissions to delete/add/modify all entries below ou=aliases, from all domains (dc=domain,ou=mail...), but only, if "description: <string>" is found (for delete/modify only, but not for add).
Is that possible?
This can be achieved by sets http://www.openldap.org/faq/data/cache/1134.html http://www.openldap.org/faq/data/cache/1132.html http://www.openldap.org/faq/data/cache/1133.html
-Dieter