Re[2]: OpenLDAP 2.2

RC> Hello,

RC> I am currently running Jamm on SuSE 9.1 with OpenLDAP
RC> 2.2.6.  I had a similar problem when I was originally
RC> setting up Jamm.  I found some OpenLDAP docs online
RC> that told me that if you're using a regex in the ACL,
RC> you need to use dn.regex instead of just dn.  Here is
RC> an example from my slapd.conf:

RC> access to
RC> dn.regex=".*,jvd=([^,]+),o=hosting,dc=example,dc=com"
RC>         attr=userPassword
RC>         by self write         by
RC> group/jammPostmaster/roleOccupant="cn=postmaster,jvd=$1,o=hosting,dc=example,dc=com"
RC> write
RC>         by anonymous auth
RC>         by * none

RC> I also changed the other access line that used a regex
RC> and now OpenLDAP 2.2 and Jamm work fine together.

RC> Rob Campbell
RC> KG6HUM

After upgrade from OpenLDAP 2.1.22 to 2.2.15 I have encountered the
same error, changed dn to dn.regex and slapd started ok.

But I discovered later that domain admins cannot change anything -
they are getting permission denied message.

So I started slapd in access-control debug mode, and found in log:


=> ldbm_back_entry_get: cannot find entry: "cn=postmaster,jvd=$1,o=example,dc=com
<= check a_dn_pat: *
<= acl_mask: [3] applying read(=rscx) (stop)
<= acl_mask: [3] mask: read(=rscx)
=> access_allowed: write access denied by read(=rscx)

After digging in man slapd.access I found that I need to add .expand
to group definition in slapd.conf, for example:

access to dn.regex=".*,jvd=([^,]+),o=example,dc=com"
       attr=userPassword by self
       write by group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=example,dc=com"
       write by anonymous
       auth by * none

Now everything is Ok

Alexander Lukach




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl