-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

greetings,

I'm trying to configure ACL, I belive it is possible to ... but after some attempts I doubt it is ...

please, help me to understand where I'm making the mistake/s ...

I need to manage possibility for "coadmins" group members to manage all except the objects of "admins" group members

forgive me please my long explanation ...

so I have:

Important: the starting point in my case is auth accounts structure:

users do auth with (lets call it) "root" objects (most upper level): uid=<USER>,ou=People,dc=abc

- ---[ accounts and groups start ]------------------------------------------- dn: uid=admin1,ou=People,dc=abc dn: uid=admin7,ou=People,dc=abc dn: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc

dn: uid=coadmin5,ou=People,dc=abc dn: uid=johndoe,authorizedService=serviceA,uid=coadmin5,ou=People,dc=abc

dn: uid=coadmin6,ou=People,dc=abc

dn: cn=admins,dc=abc memberUid: admin1 - ---[ accounts and groups end ]-------------------------------------------

group objects memberUid attribute value contains uid of the "root" objects

- ---[ group structure start ]------------------------------------------- dn: cn=coadmins,ou=group,dc=abc memberUid: coadmin5 memberUid: coadmin6 - ---[ group structure end ]-------------------------------------------

here is the ACL I managed to work as I want:

- ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]-------------------------------------------

this allows admins to manage passwords of anybody and for all other users manage passwords of self "root" account and service accounts (look structure of account objects above)

and now, I had a hope to do the same to get possibility for coadmins to manage passwords of anybody except admins, and here what I thought about:

- ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set="(([cn=admin,ou=group,dc=abc]/memberUid & this/uid) | ([cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid)) & ([cn=coadmin,ou=group,dc=abc]/memberUid & user/uid)" disclose by set="[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]-------------------------------------------

and it doesn't work

the initial idea of the second `by set=' row is: for coadmins to disallow all access to userPassword if account belongs to admin

am I right to expect:

1.1. "[cn=admin,ou=group,dc=abc]/memberUid & this/uid" is true if uid of current record is member of the group `admin'

when `this' is the very "root" account (uid=admin7,ou=People,dc=abc)

1.2. "[cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid" uid of the "root" account (uid=admin7,ou=People,dc=abc) is admin group member

when `this' is service account like: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc `this/-2' trimms it to `uid=admin7,ou=People,dc=abc' and `/uid' have to provide uid value

1.3. "[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" true if currently loggedin user uid is coadmin group member

so ... was I successfull to explain what I want? :)

- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)