RE: OpenLDAP 2.3 Access Lists

-----Original Message-----
From: [email protected] [mailto:op=
[email protected]] On Behalf Of Dan =
Burkland
Sent: Friday, May 14, 2010 12:43 PM
To: [email protected]
Subject: OpenLDAP 2.3 Access Lists

Hello all,

I have been trying as of late to secure my OpenLDAP directory and I have se=
em to run into a wall. I am trying to restrict access to certain attributes=
 for my user entries located in ou=3Dpeople,dc=3Dexample,dc=3Dcom so that o=
nly my binddn can access them. Here is a list of my current ACLs:

access to dn=3D"cn=3Dbinddn,ou=3Dsystem,ou=3Dservices,dc=3Dexample,dc=3Dcom
	attrs=3DuserPassword
	by * auth

access to dn.regex=3D"uid=3D.*,ou=3Dpeople,dc=3Dexample,dc=3Dcom" attrs=3Du=
id,uidNumber,loginShell
	by dn=3D"cn=3Dbinddn,ou=3Dsystem,ou=3Dservices,dc=3Dexample,dc=3Dcom" read
	by * none

It seems I can get the rule to match without the "attrs" argument however a=
s soon as I add that to the ACL entry I get denied access to the previously=
 listed attributes for users in ou=3Dpeople. If it helps any I am using the=
 OpenLDAP-servers 2.3.43 CentOS RPM.=20

Thanks again,

Dan
---------------------------------------------------------------------------

I was finally able to resolve my issue by replacing "none" with "break" in =
all of the user account entries.

Dan