I have users personal address books as an ou under their accounts... ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com but when I try to add an entry, I am blocked... [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 nentries=0 etime=0 I need an ACi that allows each uid account to read/write entries in OU''s under their own accounts and the only ACi''s I have are the ones inherited Craig
On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:> I have users personal address books as an ou under their accounts... > > ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com > > but when I try to add an entry, I am blocked... > > [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD > dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" > [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 > nentries=0 etime=0 > > I need an ACi that allows each uid account to read/write entries in OU''s > under their own accounts and the only ACi''s I have are the ones > inherited---- It would be great if I could get some help here. I know that in OpenLDAP, ACL''s are processed top down and so I''m looking at the ACi''s that would govern here. dc=example,dc=com has the following ACI (the second one after anonymous access)... (targetattr = "carLicense ||description ||displayName ||facsimileTelephoneNumber ||homePhone ||homePostalAddress ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo ||postOfficeBox ||postalAddress ||postalCode ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber ||telexNumber ||title ||userCertificate ||userPassword ||userSMIMECertificate ||x500UniqueIdentifier") (version 3.0; acl "Enable self write for common attributes"; allow (write) (userdn = "ldap:///self") ;) and I added one more (it''s on the bottom of the list - #7)... (targetattr = "*") (version 3.0;acl "Personal Address Books";allow (write)(userdn = "ldap:///self");) but still... [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" method=128 version=3 [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com" [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105 nentries=0 etime=0 Craig
Craig White wrote:> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: > >> I have users personal address books as an ou under their accounts... >> >> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com >> >> but when I try to add an entry, I am blocked... >> >> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD >> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" >> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 >> nentries=0 etime=0 >> >> I need an ACi that allows each uid account to read/write entries in OU''s >> under their own accounts and the only ACi''s I have are the ones >> inherited >> > ---- > It would be great if I could get some help here. >The ACL Summary error log level can provide some clues. http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting> I know that in OpenLDAP, ACL''s are processed top down and so I''m looking > at the ACi''s that would govern here. > > dc=example,dc=com has the following ACI (the second one after anonymous > access)... > > (targetattr = "carLicense ||description ||displayName > ||facsimileTelephoneNumber ||homePhone ||homePostalAddress ||initials > ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo > ||postOfficeBox ||postalAddress ||postalCode ||preferredDeliveryMethod > ||preferredLanguage ||registeredAddress ||roomNumber ||secretary > ||seeAlso ||st ||street ||telephoneNumber ||telexNumber ||title > ||userCertificate ||userPassword ||userSMIMECertificate > ||x500UniqueIdentifier") > (version 3.0; > acl "Enable self write for common attributes"; > allow (write) > (userdn = "ldap:///self") > ;) > > and I added one more (it''s on the bottom of the list - #7)... > > (targetattr = "*") (version 3.0;acl "Personal Address Books";allow > (write)(userdn = "ldap:///self");) > > but still... > > [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND > dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" > method=128 version=3 > [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97 > nentries=0 etime=0 > dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com" > [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD > dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" > [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105 > nentries=0 etime=0 > > Craig > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
On Tue, 2008-09-02 at 09:26 -0600, Rich Megginson wrote:> Craig White wrote: > > On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: > > > >> I have users personal address books as an ou under their accounts... > >> > >> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com > >> > >> but when I try to add an entry, I am blocked... > >> > >> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD > >> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" > >> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 > >> nentries=0 etime=0 > >> > >> I need an ACi that allows each uid account to read/write entries in OU''s > >> under their own accounts and the only ACi''s I have are the ones > >> inherited > >> > > ---- > > It would be great if I could get some help here. > > > The ACL Summary error log level can provide some clues. > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting---- I''ve been all over that and I understand that err=50 is insufficient access and I''ve read all the pages I can find on the wiki and the 7.1 support pages but it''s not helping. I hate to say this but I can do this so simply with OpenLDAP and I''m mystified why it is so difficult to do on Fedora-DS Craig
Rich Megginson wrote:> Craig White wrote: >> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: >> >>> I have users personal address books as an ou under their accounts... >>> >>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com >>> >>> but when I try to add an entry, I am blocked... >>> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD >>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" >>> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 >>> nentries=0 etime=0 >>> >>> I need an ACi that allows each uid account to read/write entries in >>> OU''s >>> under their own accounts and the only ACi''s I have are the ones >>> inherited >>> >> ---- >> It would be great if I could get some help here. >> > The ACL Summary error log level can provide some clues. > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting >> I know that in OpenLDAP, ACL''s are processed top down and so I''m looking >> at the ACi''s that would govern here. >> >> dc=example,dc=com has the following ACI (the second one after anonymous >> access)... >> >> (targetattr = "carLicense ||description ||displayName >> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress >> ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo >> ||postOfficeBox ||postalAddress ||postalCode >> ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress >> ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber >> ||telexNumber ||title ||userCertificate ||userPassword >> ||userSMIMECertificate ||x500UniqueIdentifier") >> (version 3.0; >> acl "Enable self write for common attributes"; >> allow (write) >> (userdn = "ldap:///self") >> ;) >> >> and I added one more (it''s on the bottom of the list - #7)... >> >> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow >> (write)(userdn = "ldap:///self");)Have you tried the "add" right, to allow users to add entries under their entries? *http://tinyurl.com/3yo88r* I''m not sure if self will work here - you might have to use a macro ACI in which the uid part of the target matches the uid part of the subject - see http://tinyurl.com/59ehxh>> >> but still... >> >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND >> dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" >> method=128 version=3 >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97 >> nentries=0 etime=0 >> dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com" >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD >> dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" >> >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105 >> nentries=0 etime=0 >> >> Craig >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> > > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
On Tue, 2008-09-02 at 09:59 -0600, Rich Megginson wrote:> Rich Megginson wrote: > > Craig White wrote: > >> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: > >> > >>> I have users personal address books as an ou under their accounts... > >>> > >>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com > >>> > >>> but when I try to add an entry, I am blocked... > >>> > >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD > >>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" > >>> > >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 > >>> nentries=0 etime=0 > >>> > >>> I need an ACi that allows each uid account to read/write entries in > >>> OU''s > >>> under their own accounts and the only ACi''s I have are the ones > >>> inherited > >>> > >> ---- > >> It would be great if I could get some help here. > >> > > The ACL Summary error log level can provide some clues. > > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting > >> I know that in OpenLDAP, ACL''s are processed top down and so I''m looking > >> at the ACi''s that would govern here. > >> > >> dc=example,dc=com has the following ACI (the second one after anonymous > >> access)... > >> > >> (targetattr = "carLicense ||description ||displayName > >> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress > >> ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo > >> ||postOfficeBox ||postalAddress ||postalCode > >> ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress > >> ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber > >> ||telexNumber ||title ||userCertificate ||userPassword > >> ||userSMIMECertificate ||x500UniqueIdentifier") > >> (version 3.0; > >> acl "Enable self write for common attributes"; > >> allow (write) > >> (userdn = "ldap:///self") > >> ;) > >> > >> and I added one more (it''s on the bottom of the list - #7)... > >> > >> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow > >> (write)(userdn = "ldap:///self");) > Have you tried the "add" right, to allow users to add entries under > their entries? > *http://tinyurl.com/3yo88r* > > I''m not sure if self will work here - you might have to use a macro ACI > in which the uid part of the target matches the uid part of the subject > - see > http://tinyurl.com/59ehxh > >>---- I''m not sure if ''self'' will work here either...nothing seems to work. This is the ACL that works for me in OpenLDAP... access to dn.regex="^ou=AddressBook,uid=([^,]+),ou=People,dc=example,dc=com$$" attrs=children,entry,inetOrgPerson,organizationalPerson by dn.exact,expand="uid=$1,ou=People,dc=example,dc=com" write by dn.exact="uid=administrator,ou=People,dc=example,dc=com" write by * none I am hesitant to fool with the access control while there are people working on the network but the above is exactly what I want to work in Fedora-DS Craig
Craig White wrote:> On Tue, 2008-09-02 at 09:59 -0600, Rich Megginson wrote: > >> Rich Megginson wrote: >> >>> Craig White wrote: >>> >>>> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: >>>> >>>> >>>>> I have users personal address books as an ou under their accounts... >>>>> >>>>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com >>>>> >>>>> but when I try to add an entry, I am blocked... >>>>> >>>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD >>>>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" >>>>> >>>>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 >>>>> nentries=0 etime=0 >>>>> >>>>> I need an ACi that allows each uid account to read/write entries in >>>>> OU''s >>>>> under their own accounts and the only ACi''s I have are the ones >>>>> inherited >>>>> >>>>> >>>> ---- >>>> It would be great if I could get some help here. >>>> >>>> >>> The ACL Summary error log level can provide some clues. >>> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting >>> >>>> I know that in OpenLDAP, ACL''s are processed top down and so I''m looking >>>> at the ACi''s that would govern here. >>>> >>>> dc=example,dc=com has the following ACI (the second one after anonymous >>>> access)... >>>> >>>> (targetattr = "carLicense ||description ||displayName >>>> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress >>>> ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo >>>> ||postOfficeBox ||postalAddress ||postalCode >>>> ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress >>>> ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber >>>> ||telexNumber ||title ||userCertificate ||userPassword >>>> ||userSMIMECertificate ||x500UniqueIdentifier") >>>> (version 3.0; >>>> acl "Enable self write for common attributes"; >>>> allow (write) >>>> (userdn = "ldap:///self") >>>> ;) >>>> >>>> and I added one more (it''s on the bottom of the list - #7)... >>>> >>>> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow >>>> (write)(userdn = "ldap:///self");) >>>> >> Have you tried the "add" right, to allow users to add entries under >> their entries? >> *http://tinyurl.com/3yo88r* >> >> I''m not sure if self will work here - you might have to use a macro ACI >> in which the uid part of the target matches the uid part of the subject >> - see >> http://tinyurl.com/59ehxh >> > ---- > I''m not sure if ''self'' will work here either...nothing seems to work. > > This is the ACL that works for me in OpenLDAP... > > access to > dn.regex="^ou=AddressBook,uid=([^,]+),ou=People,dc=example,dc=com$$" > attrs=children,entry,inetOrgPerson,organizationalPerson > by dn.exact,expand="uid=$1,ou=People,dc=example,dc=com" write > by dn.exact="uid=administrator,ou=People,dc=example,dc=com" > write > by * none > >This looks like a macro ACI. Have you tried a macro ACI in conjunction with the "add" right?> I am hesitant to fool with the access control while there are people > working on the network but the above is exactly what I want to work in > Fedora-DS > > Craig > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >