Re: Data access issue
Vincent DEBOUT <[email protected]>
| Newsgroups | gmane.network.openldap.general |
|---|---|
| Message-ID | <[email protected]> |
Jonathan Clarke a écrit : > On 02/11/2009 21:01, Vincent DEBOUT wrote: >> Hi, >> >> I have an issue to get data from my LDAP server. With root account >> everything is fine: >> >> [vincent@titan ~]$ ldapsearch -x -h ldap.morinie.fr -W -D >> "cn=Directory Manager,dc=morinie,dc=fr" -b >> "ou=personnes,dc=morinie,dc=fr" uid=vincent Enter LDAP Password: # >> extended LDIF # # LDAPv3 # base <ou=personnes,dc=morinie,dc=fr> with >> scope subtree # filter: uid=vincent # requesting: ALL # >> >> # vincent, personnes, morinie.fr dn: >> uid=vincent,ou=personnes,dc=morinie,dc=fr ... >> >> # search result search: 2 result: 0 Success >> >> # numResponses: 2 # numEntries: 1 >> >> But when I try with my own account, I get no result: >> >> [vincent@titan ~]$ ldapsearch -x -h ldap.morinie.fr -W -D >> "uid=vincent,ou=personnes,dc=morinie,dc=fr" -b >> "ou=personnes,dc=morinie,dc=fr" uid=vincent Enter LDAP Password: # >> extended LDIF # # LDAPv3 # base <ou=personnes,dc=morinie,dc=fr> with >> scope subtree # filter: uid=vincent # requesting: ALL # >> >> # search result search: 2 result: 32 No such object >> >> # numResponses: 1 >> >> Here is my access configuration file: >> >> # The root DIT should be accessible to all clients access to >> dn.exact="" by * read >> >> # So should the schema access to dn.subtree="cn=Subschema" by * read >> >> access to attr=userpassword by self write by anonymous auth by * >> none >> >> access to attr=x500uniqueIdentifier by self write by * none >> >> access to dn.one="ou=personnes, dc=morinie, dc=fr" by anonymous auth >> by self write by users write >> >> I don't understand why I can't get the data! >> >> Can you help me on this? > > Hi Vincent, > > This is because you don't have the right search on the base > "ou=personnes, dc=morinie, dc=fr". > > Your ACL gives access to all attributes in all entries *one level below* > this entry. But no access to "ou=personnes" entry itself. Hi, I added a new ACL for "ou=personnes, dc=morinie, dc=fr" to allow search and now it is working. Thank you. Vincent