How to allow users on an openLDAP server to create, update, and modify users under a certain organizationalUnit?Delegate administration rights to OU in OpenLDAP?OpenLDAP ACL to allow users to change their passwordHow to add ACIs to OpenLDAP properlySSH access to hosts groups based on user groups using LDAPOpenLDAP advanced ACL configurationerror: Automatically removed objectClass from template as it is not defined in the schemaHow to only allow users and/or groups access certain client machines that are connected to an openldap server?how to self change attrs in openldaphow to set permission the manager in openldap?OpenLDAP: Index to olcDatabase not respectedslapd with mozillaAbPersonAlpha schema

Does ratifying USMCA imply a (stealth) ratification of UNCLOS?

Could a chemically propelled craft travel directly between Earth and Mars spaceports?

Was Tyrion always a poor strategist?

Isn't Kirchhoff's junction law a violation of conservation of charge?

How to safely discharge oneself

Precedent for disabled Kings

Why aren't satellites disintegrated even though they orbit earth within earth's Roche Limits?

What should I wear to go and sign an employment contract?

Managing heat dissipation in a magic wand

Gambler's Fallacy Dice

Why does Taylor’s series “work”?

In how many ways can we partition a set into smaller subsets so the sum of the numbers in each subset is equal?

pwaS eht tirsf dna tasl setterl fo hace dorw

In Dutch history two people are referred to as "William III"; are there any more cases where this happens?

What does it mean for a program to be 32 or 64 bit?

Are there any crystals that are theoretically possible, but haven't yet been made?

How to choose the correct exposure for flower photography?

Character had a different name in the past. Which name should I use in a flashback?

Addressing an email

Is there any official Lore on Keraptis the Wizard, apart from what is in White Plume Mountain?

Head-internal relative clauses

How does the "reverse syntax" in Middle English work?

Why were early aviators' trousers flared at the thigh?

Why didn't Daenerys' advisers suggest assassinating Cersei?

How to allow users on an openLDAP server to create, update, and modify users under a certain organizationalUnit?

Delegate administration rights to OU in OpenLDAP?OpenLDAP ACL to allow users to change their passwordHow to add ACIs to OpenLDAP properlySSH access to hosts groups based on user groups using LDAPOpenLDAP advanced ACL configurationerror: Automatically removed objectClass from template as it is not defined in the schemaHow to only allow users and/or groups access certain client machines that are connected to an openldap server?how to self change attrs in openldaphow to set permission the manager in openldap?OpenLDAP: Index to olcDatabase not respectedslapd with mozillaAbPersonAlpha schema

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

I have been stuck on trying to allow openLDAP users that are in a certain group (EX: cn=Admins,dc=mydomain,dc=com) to create, modify, update, and delete users that are in another organizationalUnit (EX: ou=Users,dc=mydomain,dc=com) for about two weeks now. I have done everything in my power to try to figure this out. Such as searching through Google, searching through serverfault, and finally searching through stackoverflow but to no avail. I am fairly new to openLDAP and it is probably an error and/or something that I am overlooking with the olcAccess attribute in the dn: olcDatabase=1hdb,cn=config.

Admin Group.ldif

dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins

Users.ldif

dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users

Default olcAccess

Note: This is the default ACLs that come with a fresh install of openLDAP server.

dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read

Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.

Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.

Thanks,
Alex

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html

– Rouben
Jun 13 '16 at 22:33

@Rouben I have read the documentation already but there was no good answer to my question.

– Alex Lowe
Jun 13 '16 at 22:37

@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for 8.4.4. Managing access with Groups.

– Alex Lowe
Jun 13 '16 at 22:40

So would something like this work? access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)

– Rouben
Jun 13 '16 at 22:50

The first regex matches everything in the Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.

– Rouben
Jun 13 '16 at 22:53

|
show 5 more comments

Admin Group.ldif

dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins

Users.ldif

dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users

Default olcAccess

Note: This is the default ACLs that come with a fresh install of openLDAP server.

dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read

Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.

Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.

Thanks,
Alex

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html

– Rouben
Jun 13 '16 at 22:33

@Rouben I have read the documentation already but there was no good answer to my question.

– Alex Lowe
Jun 13 '16 at 22:37

@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for 8.4.4. Managing access with Groups.

– Alex Lowe
Jun 13 '16 at 22:40

So would something like this work? access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)

– Rouben
Jun 13 '16 at 22:50

The first regex matches everything in the Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.

– Rouben
Jun 13 '16 at 22:53

|
show 5 more comments

Admin Group.ldif

dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins

Users.ldif

dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users

Default olcAccess

Note: This is the default ACLs that come with a fresh install of openLDAP server.

dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read

Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.

Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.

Thanks,
Alex

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

Admin Group.ldif

dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins

Users.ldif

dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users

Default olcAccess

Note: This is the default ACLs that come with a fresh install of openLDAP server.

dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read

Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.

Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.

Thanks,
Alex

linux ubuntu ldap openldap access-control-list

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

edited May 23 '17 at 11:33

Community♦

edited May 23 '17 at 11:33

Community♦

edited May 23 '17 at 11:33

Community♦

asked Jun 13 '16 at 22:22

Alex Lowe

123110

asked Jun 13 '16 at 22:22

Alex Lowe

123110

asked Jun 13 '16 at 22:22

Alex Lowe

123110

The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html

– Rouben
Jun 13 '16 at 22:33

@Rouben I have read the documentation already but there was no good answer to my question.

– Alex Lowe
Jun 13 '16 at 22:37

@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for 8.4.4. Managing access with Groups.

– Alex Lowe
Jun 13 '16 at 22:40

So would something like this work? access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)

– Rouben
Jun 13 '16 at 22:50

The first regex matches everything in the Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.

– Rouben
Jun 13 '16 at 22:53

|
show 5 more comments

The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html

– Rouben
Jun 13 '16 at 22:33

@Rouben I have read the documentation already but there was no good answer to my question.

– Alex Lowe
Jun 13 '16 at 22:37

@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for 8.4.4. Managing access with Groups.

– Alex Lowe
Jun 13 '16 at 22:40

So would something like this work? access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)

– Rouben
Jun 13 '16 at 22:50

The first regex matches everything in the Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.

– Rouben
Jun 13 '16 at 22:53

The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html

– Rouben
Jun 13 '16 at 22:33

@Rouben I have read the documentation already but there was no good answer to my question.

– Alex Lowe
Jun 13 '16 at 22:37

@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for 8.4.4. Managing access with Groups.

– Alex Lowe
Jun 13 '16 at 22:40

So would something like this work? access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)

– Rouben
Jun 13 '16 at 22:50

The first regex matches everything in the Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.

– Rouben
Jun 13 '16 at 22:53

|
show 5 more comments

1 Answer
1

active

oldest

votes

The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).

In default ACLs set by Ubuntu and compliant there is the line:

olcAccess: 2to * by * read

to * by *: met everything, adding lines after has no effect at all.

The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:

olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
 by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write

and change the objectClass of the admins group to groupOfUniqueNames.

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

add a comment |

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f783746%2fhow-to-allow-users-on-an-openldap-server-to-create-update-and-modify-users-und%23new-answer', 'question_page');

);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).

In default ACLs set by Ubuntu and compliant there is the line:

olcAccess: 2to * by * read

to * by *: met everything, adding lines after has no effect at all.

The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:

olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
 by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write

and change the objectClass of the admins group to groupOfUniqueNames.

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

add a comment |

The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).

In default ACLs set by Ubuntu and compliant there is the line:

olcAccess: 2to * by * read

to * by *: met everything, adding lines after has no effect at all.

The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:

olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
 by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write

and change the objectClass of the admins group to groupOfUniqueNames.

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

add a comment |

The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).

In default ACLs set by Ubuntu and compliant there is the line:

olcAccess: 2to * by * read

to * by *: met everything, adding lines after has no effect at all.

The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:

olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
 by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write

and change the objectClass of the admins group to groupOfUniqueNames.

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).

In default ACLs set by Ubuntu and compliant there is the line:

olcAccess: 2to * by * read

to * by *: met everything, adding lines after has no effect at all.

The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:

olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
 by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write

and change the objectClass of the admins group to groupOfUniqueNames.

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

edited Aug 4 '16 at 11:49

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

answered Aug 4 '16 at 10:50

Abdelhamid MEDDEB

33124

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

add a comment |

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

And probably add olcAccess: 3to * by * read

– eckes
May 7 at 2:24

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Server Fault!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Otdfbt

1 Answer
1

Your Answer

Post as a guest

1 Answer
1

1 Answer
1

Post as a guest

Popular posts from this blog

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Post as a guest

1 Answer 1

1 Answer 1

Sign up or log in

Post as a guest

Post as a guest

Sign up or log in

Post as a guest

Sign up or log in

Post as a guest

Sign up or log in

Post as a guest

Popular posts from this blog

1 Answer
1

1 Answer
1

1 Answer
1