Hi again!

I managed to get it working by doing this:

Access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org$" by dn.exact,expand="cn=$1,ou=users,dc=diegolima,dc=org" write by * read

Access to dn="ou=Misc,dc=diegolima,dc=org" attrs=children by users write by * read

I actually needed to use "dn.exact,expand" instead of just "dn.expand" as it was not matching the client properly. I'm still trying to figure out why, so if anyone can explain this to me I'd be very appreciative :)

Anyway, its working now! Thank you!

2010/9/30 Christian Manal moenoel@informatik.uni-bremen.de:

Am 30.09.2010 02:04, schrieb Diego Lima:

...

Hello all,

I have the following structure on my LDAP server:

ou=Misc,dc=diegolima,dc=org ou=Users,dc=diegolima,dc=org

Under users I have some user accounts, such as cn=user1,ou=Users,dc=diegolima,dc=org. I'd like to allow users to create an OU under ou=Misc as long as the OU had the user's name, such as ou=user1,ou=Misc,dc=diegolima,dc=org for user1 or ou=user2,ou=Misc,dc=diegolima,dc=org for user2, however I wouldn't like to simply create an ACL such as:

access to dn.exact="ou=Misc,dc=diegolima,dc=org"     by * add

as this ultimately allows user1 to create an ou named "ou=user2,ou=Misc". What I first tried was adding an ACL like this:

access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org"     by dn.exact,expand="cn=$1,dc=diegolima,dc=org" write     by * none

However I receive an error telling me that I need write access to the parent entry to create this, and if I use the first ACL I seem to be able to create OUs without any naming restriction. Is there even a way to accomplish this?

Thank you very much!

Hi,

I think you need to add write permissions for the pseudo attribute "children" of the parent. I.E. something like this:

access to dn="ou=Misc,dc=diegolima,dc=org" attrs=children      by users write      by * none

access to dn.regex="^ou=([^,]+),ou=Misc,dc=diegolima,dc=org$"      by dn.expand="cn=$1,ou=Users,dc=diegolima,dc=org" write      by * none

That way, all authenticated users are allowed to write to child entries of "ou=Misc,..." and the "dn.regex" rule then restricts to which children users may write.

Regards, Christian Manal