How to allow users on an openLDAP server to create, update, and modify users under a certain organizationalUnit?Delegate administration rights to OU in OpenLDAP?OpenLDAP ACL to allow users to change their passwordHow to add ACIs to OpenLDAP properlySSH access to hosts groups based on user groups using LDAPOpenLDAP advanced ACL configurationerror: Automatically removed objectClass from template as it is not defined in the schemaHow to only allow users and/or groups access certain client machines that are connected to an openldap server?how to self change attrs in openldaphow to set permission the manager in openldap?OpenLDAP: Index to olcDatabase not respectedslapd with mozillaAbPersonAlpha schema
Does ratifying USMCA imply a (stealth) ratification of UNCLOS?
Could a chemically propelled craft travel directly between Earth and Mars spaceports?
Was Tyrion always a poor strategist?
Isn't Kirchhoff's junction law a violation of conservation of charge?
How to safely discharge oneself
Precedent for disabled Kings
Why aren't satellites disintegrated even though they orbit earth within earth's Roche Limits?
What should I wear to go and sign an employment contract?
Managing heat dissipation in a magic wand
Gambler's Fallacy Dice
Why does Taylor’s series “work”?
In how many ways can we partition a set into smaller subsets so the sum of the numbers in each subset is equal?
pwaS eht tirsf dna tasl setterl fo hace dorw
In Dutch history two people are referred to as "William III"; are there any more cases where this happens?
What does it mean for a program to be 32 or 64 bit?
Are there any crystals that are theoretically possible, but haven't yet been made?
How to choose the correct exposure for flower photography?
Character had a different name in the past. Which name should I use in a flashback?
Addressing an email
Is there any official Lore on Keraptis the Wizard, apart from what is in White Plume Mountain?
Head-internal relative clauses
How does the "reverse syntax" in Middle English work?
Why were early aviators' trousers flared at the thigh?
Why didn't Daenerys' advisers suggest assassinating Cersei?
How to allow users on an openLDAP server to create, update, and modify users under a certain organizationalUnit?
Delegate administration rights to OU in OpenLDAP?OpenLDAP ACL to allow users to change their passwordHow to add ACIs to OpenLDAP properlySSH access to hosts groups based on user groups using LDAPOpenLDAP advanced ACL configurationerror: Automatically removed objectClass from template as it is not defined in the schemaHow to only allow users and/or groups access certain client machines that are connected to an openldap server?how to self change attrs in openldaphow to set permission the manager in openldap?OpenLDAP: Index to olcDatabase not respectedslapd with mozillaAbPersonAlpha schema
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have been stuck on trying to allow openLDAP users that are in a certain group (EX: cn=Admins,dc=mydomain,dc=com) to create, modify, update, and delete users that are in another organizationalUnit (EX: ou=Users,dc=mydomain,dc=com) for about two weeks now. I have done everything in my power to try to figure this out. Such as searching through Google, searching through serverfault, and finally searching through stackoverflow but to no avail. I am fairly new to openLDAP and it is probably an error and/or something that I am overlooking with the olcAccess attribute in the dn: olcDatabase=1hdb,cn=config.
Admin Group.ldif
dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins
Users.ldif
dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users
Default olcAccess
Note: This is the default ACLs that come with a fresh install of openLDAP server.
dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read
Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.
Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.
Thanks,
Alex
linux ubuntu ldap openldap access-control-list
edited May 23 '17 at 11:33
Community♦
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
|
show 5 more comments
I have been stuck on trying to allow openLDAP users that are in a certain group (EX: cn=Admins,dc=mydomain,dc=com) to create, modify, update, and delete users that are in another organizationalUnit (EX: ou=Users,dc=mydomain,dc=com) for about two weeks now. I have done everything in my power to try to figure this out. Such as searching through Google, searching through serverfault, and finally searching through stackoverflow but to no avail. I am fairly new to openLDAP and it is probably an error and/or something that I am overlooking with the olcAccess attribute in the dn: olcDatabase=1hdb,cn=config.
Admin Group.ldif
dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins
Users.ldif
dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users
Default olcAccess
Note: This is the default ACLs that come with a fresh install of openLDAP server.
dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read
Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.
Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.
Thanks,
Alex
linux ubuntu ldap openldap access-control-list
edited May 23 '17 at 11:33
Community♦
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for8.4.4. Managing access with Groups.
– Alex Lowe
Jun 13 '16 at 22:40
So would something like this work?access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manageBy the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently...by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$"These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)
– Rouben
Jun 13 '16 at 22:50
The first regex matches everything in theUsersOU, the second regex (assuming syntax is right, I made it up) matches everything in theAdminsOU.
– Rouben
Jun 13 '16 at 22:53
|
show 5 more comments
I have been stuck on trying to allow openLDAP users that are in a certain group (EX: cn=Admins,dc=mydomain,dc=com) to create, modify, update, and delete users that are in another organizationalUnit (EX: ou=Users,dc=mydomain,dc=com) for about two weeks now. I have done everything in my power to try to figure this out. Such as searching through Google, searching through serverfault, and finally searching through stackoverflow but to no avail. I am fairly new to openLDAP and it is probably an error and/or something that I am overlooking with the olcAccess attribute in the dn: olcDatabase=1hdb,cn=config.
Admin Group.ldif
dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins
Users.ldif
dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users
Default olcAccess
Note: This is the default ACLs that come with a fresh install of openLDAP server.
dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read
Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.
Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.
Thanks,
Alex
linux ubuntu ldap openldap access-control-list
edited May 23 '17 at 11:33
Community♦
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
I have been stuck on trying to allow openLDAP users that are in a certain group (EX: cn=Admins,dc=mydomain,dc=com) to create, modify, update, and delete users that are in another organizationalUnit (EX: ou=Users,dc=mydomain,dc=com) for about two weeks now. I have done everything in my power to try to figure this out. Such as searching through Google, searching through serverfault, and finally searching through stackoverflow but to no avail. I am fairly new to openLDAP and it is probably an error and/or something that I am overlooking with the olcAccess attribute in the dn: olcDatabase=1hdb,cn=config.
Admin Group.ldif
dn: cn=Admins,dc=ldapserver,dc=com
changetype: add
objectClass: groupOfNames
objectClass: top
member: cn=admin,ou=Users,dc=ldapserver,dc=com
cn: Admins
Users.ldif
dn: ou=Users,dc=ldapserver,dc=com
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: Users
Default olcAccess
Note: This is the default ACLs that come with a fresh install of openLDAP server.
dn: olcDatabase=1hdb,cn=config
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to * by * read
Please Note 1: Because I am fairly new to openLDAP I have not set any other ACLs other than the ones that come defaultly when you first install the openLDAP server.
Please Note 2: Before I Asked my question I tried this question here which obviously has not worked for me.
Thanks,
Alex
linux ubuntu ldap openldap access-control-list
linux ubuntu ldap openldap access-control-list
edited May 23 '17 at 11:33
Community♦
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
edited May 23 '17 at 11:33
Community♦
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
edited May 23 '17 at 11:33
Community♦
1
edited May 23 '17 at 11:33
Community♦
1
edited May 23 '17 at 11:33
Community♦
1
1
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
asked Jun 13 '16 at 22:22
Alex LoweAlex Lowe
123110
123110
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for8.4.4. Managing access with Groups.
– Alex Lowe
Jun 13 '16 at 22:40
So would something like this work?access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manageBy the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently...by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$"These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)
– Rouben
Jun 13 '16 at 22:50
The first regex matches everything in theUsersOU, the second regex (assuming syntax is right, I made it up) matches everything in theAdminsOU.
– Rouben
Jun 13 '16 at 22:53
|
show 5 more comments
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for8.4.4. Managing access with Groups.
– Alex Lowe
Jun 13 '16 at 22:40
So would something like this work?access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manageBy the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently...by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$"These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)
– Rouben
Jun 13 '16 at 22:50
The first regex matches everything in theUsersOU, the second regex (assuming syntax is right, I made it up) matches everything in theAdminsOU.
– Rouben
Jun 13 '16 at 22:53
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for
8.4.4. Managing access with Groups.– Alex Lowe
Jun 13 '16 at 22:40
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for
8.4.4. Managing access with Groups.– Alex Lowe
Jun 13 '16 at 22:40
So would something like this work?
access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)– Rouben
Jun 13 '16 at 22:50
So would something like this work?
access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manage By the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently... by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$" These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)– Rouben
Jun 13 '16 at 22:50
The first regex matches everything in the
Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.– Rouben
Jun 13 '16 at 22:53
The first regex matches everything in the
Users OU, the second regex (assuming syntax is right, I made it up) matches everything in the Admins OU.– Rouben
Jun 13 '16 at 22:53
|
show 5 more comments
1 Answer
1
active
oldest
votes
The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).
In default ACLs set by Ubuntu and compliant there is the line:
olcAccess: 2to * by * read
to * by *: met everything, adding lines after has no effect at all.
The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write
and change the objectClass of the admins group to groupOfUniqueNames.
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
And probably addolcAccess: 3to * by * read
– eckes
May 7 at 2:24
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f783746%2fhow-to-allow-users-on-an-openldap-server-to-create-update-and-modify-users-und%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).
In default ACLs set by Ubuntu and compliant there is the line:
olcAccess: 2to * by * read
to * by *: met everything, adding lines after has no effect at all.
The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write
and change the objectClass of the admins group to groupOfUniqueNames.
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
And probably addolcAccess: 3to * by * read
– eckes
May 7 at 2:24
add a comment |
The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).
In default ACLs set by Ubuntu and compliant there is the line:
olcAccess: 2to * by * read
to * by *: met everything, adding lines after has no effect at all.
The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write
and change the objectClass of the admins group to groupOfUniqueNames.
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
And probably addolcAccess: 3to * by * read
– eckes
May 7 at 2:24
add a comment |
The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).
In default ACLs set by Ubuntu and compliant there is the line:
olcAccess: 2to * by * read
to * by *: met everything, adding lines after has no effect at all.
The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write
and change the objectClass of the admins group to groupOfUniqueNames.
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
The ACLs, in openldap, is always evaluated from top to bottom of the list of lines numbered 0, 1,..As soon as a condition is met, evaluation is immediately stopped (assuming break not used).
In default ACLs set by Ubuntu and compliant there is the line:
olcAccess: 2to * by * read
to * by *: met everything, adding lines after has no effect at all.
The solution discussed on this link and above should solve your problem, I suggest you try this ACL list:
olcAccess: 0to attrs=userPassword by self write by anonymous auth by * none
olcAccess: 1to attrs=shadowLastChange by self write by * read
olcAccess: 2to dn.subtree="ou=Users,dc=ldapserver,dc=com"
by group/groupOfUniqueNames/uniqueMember="cn=Admins,dc=ldapserver,dc=com" write
and change the objectClass of the admins group to groupOfUniqueNames.
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
edited Aug 4 '16 at 11:49
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
answered Aug 4 '16 at 10:50
Abdelhamid MEDDEBAbdelhamid MEDDEB
33124
33124
And probably addolcAccess: 3to * by * read
– eckes
May 7 at 2:24
add a comment |
And probably addolcAccess: 3to * by * read
– eckes
May 7 at 2:24
And probably add
olcAccess: 3to * by * read– eckes
May 7 at 2:24
And probably add
olcAccess: 3to * by * read– eckes
May 7 at 2:24
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f783746%2fhow-to-allow-users-on-an-openldap-server-to-create-update-and-modify-users-und%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The OpenLDAP documentation on ACLs is quite comprehensive, albeit not a short read by all means. Having said that, it's worth checking out. There are plenty of examples that may come in handy. openldap.org/doc/admin24/access-control.html
– Rouben
Jun 13 '16 at 22:33
@Rouben I have read the documentation already but there was no good answer to my question.
– Alex Lowe
Jun 13 '16 at 22:37
@Rouben There was an answer that allowed a certain group of people to change passwords of other users which can be found here and search for
8.4.4. Managing access with Groups.– Alex Lowe
Jun 13 '16 at 22:40
So would something like this work?
access to dn.regex="(.+,)?ou=Users,dc=mydomain,dc=com$" by group.exact="cn=Admins,dc=mydomain,dc=com" manageBy the way, the "Admins" group should be a cn not an ou. An OU is meant to contain objects (like users or groups), and a group is an object. If you have Admins set up as an OU, then you probably need to match it differently...by group.regex="(.+,)?ou=Admins,dc=mydomain,dc=com$"These are untested, by the way, and I admit that I am no LDAP expert... Just trying to make sense of the documentation. :)– Rouben
Jun 13 '16 at 22:50
The first regex matches everything in the
UsersOU, the second regex (assuming syntax is right, I made it up) matches everything in theAdminsOU.– Rouben
Jun 13 '16 at 22:53