OpenLDAP 2.3 Access Lists

Dan Burkland <[email protected]> Fri, 14 May 2010 12:43:13 -0500
Newsgroups gmane.network.openldap.general
Message-ID <[email protected]>
Hello all,

I have been trying as of late to secure my OpenLDAP directory and I have se=
em to run into a wall. I am trying to restrict access to certain attributes=
 for my user entries located in ou=3Dpeople,dc=3Dexample,dc=3Dcom so that o=
nly my binddn can access them. Here is a list of my current ACLs:

access to dn=3D"cn=3Dbinddn,ou=3Dsystem,ou=3Dservices,dc=3Dexample,dc=3Dcom
	attrs=3DuserPassword
	by * auth

access to dn.regex=3D"uid=3D.*,ou=3Dpeople,dc=3Dexample,dc=3Dcom" attrs=3Du=
id,uidNumber,loginShell
	by dn=3D"cn=3Dbinddn,ou=3Dsystem,ou=3Dservices,dc=3Dexample,dc=3Dcom" read
	by * none

It seems I can get the rule to match without the "attrs" argument however a=
s soon as I add that to the ACL entry I get denied access to the previously=
 listed attributes for users in ou=3Dpeople. If it helps any I am using the=
 OpenLDAP-servers 2.3.43 CentOS RPM.=20

Thanks again,

Dan