[389-users] Chaining and LDAP_UNWILLING_TO_PERFORM problem

[Roberto Polli]

On Thursday 23 July 2009 19:10:26 Rich Megginson wrote:> >>> case1)
> >>> * I bind with uid=admin to the local DS tree to modify the "givenName"
> >>> of a user on the remote server
> >>> * the modify is successful, as the uid=admin is proxied and the
> >>> "uid=admin" is replicated on the remote server
> >>>
> >>> case2)
> >>> * same as case1 but I try to modify "userPassword"
> >>> * the modify fails as the remote server won't evaluate aci on
> >>> "uid=admin" but on "dn:proxyuser"
> >>

> So the user uid=admin - is that the Directory Manager (rootdn)? 
no

> If not,
> is it a member of roledn = "ldap:///cn=SA role,dc=babel,dc=it"?
yes, and it can modify users' attribute, but password

> Does roledn = "ldap:///cn=SA role,dc=babel,dc=it" exist on both the
> local and remote servers?
yes

it seems that when I try to modify userPassword, the reference to uid=admin is 
not forwarded and only the proxyuser rights are used..


Peace,
R.
-- 

Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)

"Il seguente messaggio contiene informazioni riservate. Qualora questo 
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene 
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio 
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto 
della legge in materia di protezione dei dati personali."