Antw: Re: Re[2]: OpenLDAP 2.2

Hello,

according to the changes file of openldap 2.2.18,
this expand style hass been added in 2.2.7  :-(


OpenLDAP 2.2.7 Release 
	Added slapd ACL peername/expand styles (ITS#2907, ITS#3010) 


Had you success with a new openldap version on SuSE 9.1 ?

Perhaps add a note to the howto, that when using openldap 2.2.x
it requires openldap 2.2.7 or up.

Otherwise you can apoint postmasters, but they won't have enough
rights to do changes.

André


>>> [email protected] 04.10.2004 17:27:56 >>>
On Mon, 4 Oct 2004 16:43:37 +0200, Lukach Alexander <[email protected]>  
wrote:


hi this doesnt seem to work for me (openldap 2.2.6),
seems .expand is conflicting with .regex ..
i get :
"slapd.conf: line 88: unknown style "expand" in by clause"
and 'man slapd.access' says:
"The optional domainstyle qualifier of the domain clause allows a modifier  
option; the only value  currently  supported  is
        expand, which causes substring substitution of submatches to take  
place even if the domainstyle is not regex.."
the last part there... :)


anyway really need this to work :)
maybe it's just a matter of upgrading openldap...suse doesnt seem to think  
there is a need for that though :(
...which makes it alot harder for me to test, havent got the time now  
anyway..

mvh
Bjørn Magnus Mathisen

> RC> Hello,
>
> RC> I am currently running Jamm on SuSE 9.1 with OpenLDAP
> RC> 2.2.6.  I had a similar problem when I was originally
> RC> setting up Jamm.  I found some OpenLDAP docs online
> RC> that told me that if you're using a regex in the ACL,
> RC> you need to use dn.regex instead of just dn.  Here is
> RC> an example from my slapd.conf:
>
> RC> access to
> RC> dn.regex=".*,jvd=([^,]+),o=hosting,dc=example,dc=com"
> RC>         attr=userPassword
> RC>         by self write         by
> RC>  
> group/jammPostmaster/roleOccupant="cn=postmaster,jvd=$1,o=hosting,dc=example,dc=com"
> RC> write
> RC>         by anonymous auth
> RC>         by * none
>
> RC> I also changed the other access line that used a regex
> RC> and now OpenLDAP 2.2 and Jamm work fine together.
>
> RC> Rob Campbell
> RC> KG6HUM
>
> After upgrade from OpenLDAP 2.1.22 to 2.2.15 I have encountered the
> same error, changed dn to dn.regex and slapd started ok.
>
> But I discovered later that domain admins cannot change anything -
> they are getting permission denied message.
>
> So I started slapd in access-control debug mode, and found in log:
>
>
> => ldbm_back_entry_get: cannot find entry:  
> "cn=postmaster,jvd=$1,o=example,dc=com
> <= check a_dn_pat: *
> <= acl_mask: [3] applying read(=rscx) (stop)
> <= acl_mask: [3] mask: read(=rscx)
> => access_allowed: write access denied by read(=rscx)
>
> After digging in man slapd.access I found that I need to add .expand
> to group definition in slapd.conf, for example:
>
> access to dn.regex=".*,jvd=([^,]+),o=example,dc=com"
>        attr=userPassword by self
>        write by  
> group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=example,dc=com"
>        write by anonymous
>        auth by * none
>
> Now everything is Ok
>
> Alexander Lukach
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> Use IT products in your business? Tell us what you think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out  
> more
> http://productguide.itmanagersjournal.com/guidepromo.tmpl 
> _______________________________________________
> Jamm-users mailing list
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/jamm-users 



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/ 


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl 
_______________________________________________
Jamm-users mailing list
[email protected] 
https://lists.sourceforge.net/lists/listinfo/jamm-users


-------------------------------------------------------
This Newsletter Sponsored by: Macrovision 
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate 
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/