Not a bad idea although its not as visually logical as I would like it to be and I'm not sure if unix/linux would misinterpret them as group members. Something to work with though, thanks.
Tyler
On Thu, 04 Jun 2009 16:09:37 +0200 Christian Manal moenoel@informatik.uni-bremen.de wrote:
Tyler Gates wrote:
Tyler Gates wrote:
Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields
What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed.
psuedo code would be something as follows:
access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write
Thanks, Tyler
Hi,
you can use sets for this:
access to dn.regex="^(cn=[^,]+,ou=groups,dc=example,dc=com)$" attrs="sn" by set.expand="[cn=admin,$1]/memberUid & user/uid" writeRegards, Christian
Hi Christian, I think I get the set's but that ACL doesn't work, and I'm not sure if regex's or set's will even do the job. A conditional statement if possible may be the only way. Again I'm looking for members of an organizational role (cn=admin,cn=groupname,ou=group,dc=example,dc=com) placed in a group (cn=groupname,ou=group,dc=example,dc=com) to be able to access ONLY the people listed in that group (group/OrganizationalRole/memberUid((cn=groupname,ou=group,dc=example,dc=com)) and nobody else. The people listed in that group are the memberUid and should match up to the complete dn as defined in uid=<memberUid>,ou=people,dc=example,dc=com.
Tyler
I'm sorry, I think I misunderstood what you wanted to accomplish. So you want the members of
'cn=admin,cn=<groupname>,ou=group,...'
to have access to the accounts of all <memberUid>s of <groupname>?
'uid=<memberUid>,ou=people,...'
If that is even possible in that structure, I have no idea how to do it. Why don't you put the 'admin users' in a different attribute of the same group, without the 'cn=admin' child object? That way you could use a set or group ACL.
Regards, Christian