Bogdan Rudas wrote:
Hello all,
I would like to start use of olcAccess rules, are there
human-friendly editor for that ACLs?
Use any editor you wish. It is just text!
I can't even use line breaks in ldif file to make my restrictions
a
bit more readable!
One can use line breaks, no problem. But understanding ldif
file
syntax is important.
Often one have very long lines in ldif files.
A standard terminal has a width of 80 characters. Longer lines get
broken at charakter 78. 79 charakter is a newline "\n", 80 character
is one space " ". So the output you get looks like this:
line no text
1 "78 byte" + "\n"
2 "one space" + "next 78 bytes + "\n"
3 "one space" + "next 78 bytes + "\n"
This happens during a ldapsearch operation. If you upload this
ldif to a ldapserver these two bytes "\n " will be removed.
Conclusion:
One may add a newline to a ldif file by adding two characters
"\n + space". You may add as many newline you wish.
i.e.
open
l
a
p
becomes "openlap" after opload.
open
l
a
p
becomes "open l ap" after upload
I strongly dislike very long string values, one
day this will cause mistake and access violation.
I've tried with Apache DS, ldif import and few puppet modules,
everything require huge line ACL.
No, not really. They just require proper formated
ldif input.
man ldif, section "ENTRY RECORD EXAMPLE", attribute jpegPhoto
Any help will be welcome.
read this thread:
http://www.openldap.org/lists/openldap-technical/201402/threads.html#00105
here is a small filter which may help you:
# cat $(which fmt_olcAccess)
#!/bin/sed -rf
# Author: Harry Jede
# produce human readable but still machine parseable
# olcAccess lines and removes the ordering numbers in {}
# because humans don't need them, really.
# the hole script
s/^(olcAccess: )\{[[:digit:]]+\}(.*$)/\1\2/
$!{H;d}
${H;g;s/\n //g;s/[[:space:]]+by /\n by /g}
info sed explains the commands
in short
line 1: removes the ordering numbers
line 2: concatenate all lines into hold buffer
line 3: move hold buffer back to pattern buffer
s/\n //g delete any occurance of "\n "
finally search for " by" and add a
ldif line break in front of " by"
--
Harry Jede