I prefer to define specific access like :

Reader anonymous can only auth, user after authentification can read and modify And i don't want to enter the cn=admin user password into client software, so i try to create a cn=redmine-user which i can use to bind with redmine ldap authentification, and which have right to write only a group ou=redmine .

Desactivate the anonymous Bind globally :

dn: cn=config changetype: modify add: olcDisallows olcDisallows: bind_anon

To force authentification globaly :

dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcRequires olcRequires: authc

Or here an equivalent with ACL ? (but i don't see the difference between this two type of configuration ... )

olcaccess: to attrs=userPassword by self read by anonymous auth by * none

And after i need to make an ACL to authorize my cn=redmine-user to write only a group ou=redmine, but i have no idea to write this.

What do you think about that ? Thanks, best regards, Sr

On Sun, Dec 11, 2011 at 8:18 AM, Dieter Klünter dieter@dkluenter.de wrote:

Am Sat, 10 Dec 2011 14:14:58 +0100 schrieb rey sebastien reyman64@gmail.com:

...

Hello,

I search some information to make reader-only users on my openLDAP ..

I have already cn=reader-only, and my dn equal "dc=parisgeo,dc=cnrs,dc=fr"

How can i create a .ldif with specific configuration to remove anonymous user reading, and authorize the read of my ldap only with the cn=reader-only authentification ?

you may either make use of the database specific configuration parameter 'olcReadOnly: TRUE' as described in man slapd-config(5) or define an appropriate access rule, see man slapd-access(5) for further information.

-Dieter

-- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E