Thanks, but not quite

if I have a group

cn=mygroup,ou=Groups,dc=....

then I also have a subgroup

cn=admin,cn=mygroup,ou=groups,dc=....

I want the members of the subgroup to have write access to the parent group, and the members of the parent group to only have read access.

Zdenek Styblik wrote:

Darryl Moore wrote:

...

I'm trying to set up access controls for the server. Here are the rules I am trying to impliment

olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none olcAccess: {1}to dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none olcAccess: {2}to dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none olcAccess: {3}to dn.regex="cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=Admin,cn=$1,ou=Groups,dc=moores,dc=ca" write by group="cn=Management,ou=Groups,dc=moores,dc=ca" write by users read olcAccess: {4}to dn.base="ou=Groups,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {5}to dn.base="ou=People,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {6}to * by users read by * none

Basically I have groups, and within those groups I have Contact lists and administrators. I want the administrator to have write access, other members to have read access, and non members to have none.

This rule is what I think should work for that:

dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none

I know this rule works for individual user contact lists:

dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none

I think the problem I am running into is having the <who> field as

group.exact,expand

Can I not do this? If not, is there any way to acheive the same result?

thanks, darryl

by ssf=128 set="[cn=admin,ou=groups,dc=domain,dc=tld]/member & user" write

->

any member of group 'admin' (groupOfNames) can write to...

I'm not sure if that's what you're trying to do.

Zdenek

On 23/07/2009 18:22, Darryl Moore wrote:

Thanks Zdenek, Going back to my books I am learning more thanks to your comment. I think I understand what you are saying, but to work I still need to be able to expand the regular expression

so even with set="cn=..../member*" it would have to be set,expand="cn.../member*". because I have to match the group. I don't have a central admin group.

from what I've seen ",expand" only works with dn. constructs. Is that right? How else can I do this?

cheers, darryl

Darryl Moore wrote:

...

Thanks, but not quite

if I have a group

cn=mygroup,ou=Groups,dc=....

then I also have a subgroup

cn=admin,cn=mygroup,ou=groups,dc=....

I want the members of the subgroup to have write access to the parent group, and the members of the parent group to only have read access.

You could probably achieve this with something like:

access to dn.children=ou=groups,dc=.... by set="([ldap:///] + this + [??one?cn=admin])/member & user" write by set="this/member & user" read

This will search for an entry named "cn=admin" on one level under each group in ou=groups, and allow write access to it's members.

Hope this helps, Jonathan

...

Zdenek Styblik wrote:

...

Darryl Moore wrote:

...

I'm trying to set up access controls for the server. Here are the rules I am trying to impliment

olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none olcAccess: {1}to dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none olcAccess: {2}to dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none olcAccess: {3}to dn.regex="cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=Admin,cn=$1,ou=Groups,dc=moores,dc=ca" write by group="cn=Management,ou=Groups,dc=moores,dc=ca" write by users read olcAccess: {4}to dn.base="ou=Groups,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {5}to dn.base="ou=People,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {6}to * by users read by * none

Basically I have groups, and within those groups I have Contact lists and administrators. I want the administrator to have write access, other members to have read access, and non members to have none.

This rule is what I think should work for that:

dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none

I know this rule works for individual user contact lists:

dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none

I think the problem I am running into is having the<who> field as

group.exact,expand

Can I not do this? If not, is there any way to acheive the same result?

thanks, darryl

by ssf=128 set="[cn=admin,ou=groups,dc=domain,dc=tld]/member& user" write

->

any member of group 'admin' (groupOfNames) can write to...

I'm not sure if that's what you're trying to do.

Zdenek