Bogdan Rudas wrote:

> Hello all,


> I would like to start use of olcAccess rules, are there

> human-friendly editor for that ACLs?

Use any editor you wish. It is just text!


> I can't even use line breaks in ldif file to make my restrictions a

> bit more readable!

One can use line breaks, no problem. But understanding ldif file

syntax is important.


Often one have very long lines in ldif files.


A standard terminal has a width of 80 characters. Longer lines get

broken at charakter 78. 79 charakter is a newline "\n", 80 character

is one space " ". So the output you get looks like this:


line no text

1 "78 byte" + "\n"

2 "one space" + "next 78 bytes + "\n"

3 "one space" + "next 78 bytes + "\n"


This happens during a ldapsearch operation. If you upload this

ldif to a ldapserver these two bytes "\n " will be removed.



One may add a newline to a ldif file by adding two characters

"\n + space". You may add as many newline you wish.









becomes "openlap" after opload.







becomes "open l ap" after upload


> I strongly dislike very long string values, one

> day this will cause mistake and access violation.


> I've tried with Apache DS, ldif import and few puppet modules,

> everything require huge line ACL.

No, not really. They just require proper formated ldif input.

man ldif, section "ENTRY RECORD EXAMPLE", attribute jpegPhoto


> Any help will be welcome.

read this thread:


here is a small filter which may help you:


# cat $(which fmt_olcAccess)


#!/bin/sed -rf

# Author: Harry Jede

# produce human readable but still machine parseable

# olcAccess lines and removes the ordering numbers in {}

# because humans don't need them, really.


# the hole script

s/^(olcAccess: )\{[[:digit:]]+\}(.*$)/\1\2/


${H;g;s/\n //g;s/[[:space:]]+by /\n by /g}


info sed explains the commands

in short

line 1: removes the ordering numbers

line 2: concatenate all lines into hold buffer

line 3: move hold buffer back to pattern buffer

s/\n //g delete any occurance of "\n "

finally search for " by" and add a

ldif line break in front of " by"



Harry Jede