[Fedora-directory-users] ACI help

[Craig White]

On Tue, 2008-09-02 at 09:59 -0600, Rich Megginson wrote:
> Rich Megginson wrote:
> > Craig White wrote:
> >> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:
> >>  
> >>> I have users personal address books as an ou under their accounts...
> >>>
> >>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com
> >>>
> >>> but when I try to add an entry, I am blocked...
> >>>
> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD
> >>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" 
> >>>
> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105
> >>> nentries=0 etime=0
> >>>
> >>> I need an ACi that allows each uid account to read/write entries in 
> >>> OU's
> >>> under their own accounts and the only ACi's I have are the ones
> >>> inherited
> >>>     
> >> ----
> >> It would be great if I could get some help here.
> >>   
> > The ACL Summary error log level can provide some clues.  
> > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
> >> I know that in OpenLDAP, ACL's are processed top down and so I'm looking
> >> at the ACi's that would govern here.
> >>
> >> dc=example,dc=com has the following ACI (the second one after anonymous
> >> access)...
> >>
> >> (targetattr = "carLicense ||description ||displayName  
> >> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress 
> >> ||initials  ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo  
> >> ||postOfficeBox ||postalAddress ||postalCode 
> >> ||preferredDeliveryMethod  ||preferredLanguage ||registeredAddress 
> >> ||roomNumber ||secretary  ||seeAlso ||st ||street ||telephoneNumber 
> >> ||telexNumber ||title  ||userCertificate ||userPassword 
> >> ||userSMIMECertificate  ||x500UniqueIdentifier")
> >> (version 3.0;
> >> acl "Enable self write for common attributes";
> >> allow (write)
> >> (userdn = "ldap:///self")
> >> ;)
> >>
> >> and I added one more (it's on the bottom of the list - #7)...
> >>
> >> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow  
> >> (write)(userdn = "ldap:///self");)
> Have you tried the "add" right, to allow users to add entries under 
> their entries?
> *http://tinyurl.com/3yo88r*
> 
>  I'm not sure if self will work here - you might have to use a macro ACI 
> in which the uid part of the target matches the uid part of the subject 
> - see
> http://tinyurl.com/59ehxh
> >>
----
I'm not sure if 'self' will work here either...nothing seems to work.

This is the ACL that works for me in OpenLDAP...

access to
dn.regex="^ou=AddressBook,uid=([^,]+),ou=People,dc=example,dc=com$$"
        attrs=children,entry,inetOrgPerson,organizationalPerson
        by dn.exact,expand="uid=$1,ou=People,dc=example,dc=com" write
        by dn.exact="uid=administrator,ou=People,dc=example,dc=com"
write
        by * none

I am hesitant to fool with the access control while there are people
working on the network but the above is exactly what I want to work in
Fedora-DS

Craig