Hello to all,
I need your help with OpenLDAP ACL.
Here is my DIT :
dc=example,dc=com ou=Users uid=user1 uid=user2 ou=Groups cn=... cn=...
I use that to do Unix Auth with pam. It works fine.
Now, i need to modify my tree like that :
dc=example,dc=com ou=Users uid=user1 uid=user2 ou=Foo uid=user3 uid=user4 ou=Groups cn=... cn=...
So, I've added the OU "foo" to "Ou=Users".
In my network, all PCs are configured with pam_ldap reading "dc=example,dc=com". So, when i do :
$ getent passwd
I have :
user1 user2 user3 user4
What I want :
* if i'm "Ou=Users" member, for example "user1", with pam_ldap suffix : "dc=example,dc=com" :
$ getent passwd user1 user2
* if i'm "Ou=Foo" member, for example "user_b", with pam_ldap suffix : "dc=example,dc=com" :
$ getent passwd user3 user4
Is it possible to do so without modifying the DIT structure ? (only with ACL ?)
Thanks a lot for your help.
On Mon, Sep 03, 2012 at 03:05:50PM +0200, Alexis GÜNST HORN wrote:
dc=example,dc=com ou=Users uid=user1 uid=user2 ou=Foo uid=user3 uid=user4 ou=Groups cn=... cn=...
What I want :
- if i'm "Ou=Users" member, for example "user1", with pam_ldap
suffix : "dc=example,dc=com" :
$ getent passwd user1 user2
- if i'm "Ou=Foo" member, for example "user_b", with pam_ldap suffix
: "dc=example,dc=com" :
$ getent passwd user3 user4
Is it possible to do so without modifying the DIT structure ? (only with ACL ?)
Rather unlikely, as 'getent passwd' is a Unix/Linux command that gets to LDAP via NSS. The LDAP server will not know the identity of the end-user, so cannot return different results to different people.
Further, most systems that use NSS LDAP have a cache/proxy process between the getent API and the LDAP client library. That means that the LDAP client library sees *all* requests coming from the same process and thus the same user ID.
If your 'Foo' users and your 'Users' users are on separate machines then you could do something: move ou=Foo up alongside ou=Users and configure NSS/PAM on each machine to access just the relevant subtree.
Andrew
openldap-technical@openldap.org
-
Alexis GÜNST HORN -
Andrew Findlay