[Fedora-directory-users] ACI help

[Craig White]

On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:
> I have users personal address books as an ou under their accounts...
> 
> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com
> 
> but when I try to add an entry, I am blocked...
> 
> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD
> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com"
> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105
> nentries=0 etime=0
> 
> I need an ACi that allows each uid account to read/write entries in OU's
> under their own accounts and the only ACi's I have are the ones
> inherited
----
It would be great if I could get some help here.

I know that in OpenLDAP, ACL's are processed top down and so I'm looking
at the ACi's that would govern here.

dc=example,dc=com has the following ACI (the second one after anonymous
access)...

(targetattr = "carLicense ||description ||displayName  
||facsimileTelephoneNumber ||homePhone ||homePostalAddress ||initials  
||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo  
||postOfficeBox ||postalAddress ||postalCode ||preferredDeliveryMethod  
||preferredLanguage ||registeredAddress ||roomNumber ||secretary  
||seeAlso ||st ||street ||telephoneNumber ||telexNumber ||title  
||userCertificate ||userPassword ||userSMIMECertificate  
||x500UniqueIdentifier")
(version 3.0;
acl "Enable self write for common attributes";
allow (write)
(userdn = "ldap:///self")
;)

and I added one more (it's on the bottom of the list - #7)...

(targetattr = "*") (version 3.0;acl "Personal Address Books";allow  
(write)(userdn = "ldap:///self");)

but still...

[31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND  
dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com"  
method=128 version=3
[31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97  
nentries=0 etime=0  
dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com"
[31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD  
dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com"
[31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105  
nentries=0 etime=0

Craig