The reason for wanting to do this is to ensure that a user only sees the groups that they can edit when they are using LDAP Account Manager. We have quite a large number of groups and I am trying to head off users complaining that they can't find the group they need to edit.
I've been experimenting with the ACLs to try to get it to work but I can only get it to work if the owner is explicitly mentioned, rather than indirectly mentioned as per the "member of a group" approach.
The ACLs so far are:
access to dn.one="dc=example,dc=com"
by users read
by * none
access to dn.one="ou=groups,dc=example,dc=com"
by users read
by * none
access to dn.sub="ou=groups,dc=example,dc=com"
attrs=objectClass,uniqueMember
by users read
by * none
access to dn.sub="ou=groups,dc=example,dc=com"
by dnattr="owner" write
by users none
by * none
access to dn.sub="ou=groups,dc=example,dc=com"
by set="this/owner/uniqueMember & user" write
by users none
by * none
(I know that having 'by users none' is redundant but it is there to be explicit)
The purpose of the ACLs is
1. Allow everyone to see the OU structure in the domain.
2. Allow everyone to see the OUs within the groups OU.
3. The intention here is to grant enough access to the attributes of a group so that slapd can then evaluate the uniqueMember attribute. It isn't entirely clear to me whether slapd needs a rule like this or should be able to evaluate membership etc before it applies acls for the user.
4. Allow directly mentioned owners to write, nothing to everyone else.
5. Allow indirectly mentioned owners to write, nothing to everyone else.
Thanks for any suggestions/observations.
Philip