[389-users] ACI Confusion (New to 389 Came from OL):

[Anthony Messina]

Hello, firstly, thanks for 389!  I have just migrated my small domain from OL 
to 389 DS including some basic replication and have found it to be a solid, 
reliable and quick system.

I am however having a lot of confusion with ACIs.  I am trying to create ACIs 
with the same specificity that I had with OL and eGroupWare 
(http://egroupware.org), but can't seem to get one of them figured out.

This is what I'm trying to accomplish (in OL format):
access to 
dn.regex="^ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
        attrs=children
        by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
        by * none

access to 
dn.regex="^cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
        attrs=entry
        by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
        by 
dn.exact,expand="uid=$1,ou=accounts,ou=$2,o=eGroupWare,dc=messinet,dc=com" 
read
        by * none

access to 
dn.regex="cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
        by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
        by 
dn.exact,expand="uid=$1,ou=accounts,ou=$2,o=eGroupWare,dc=messinet,dc=com" 
write
        by * none

I have tried using the following in 389 DS to no avail.
On the ou=messinet.com,ou=eGW,dc=messinet,dc=com entry...

(targetattr = "*") (target = 
"ldap:///cn=($dn),ou=personal,ou=contacts,ou=messinet.com,ou=eGW,dc=messinet,dc=com") 
(version 3.0;acl "eGW personal addressbook access";allow 
(read,compare,search,write,delete,add)(userdn = 
"ldap:///uid=($dn),ou=accounts,ou=messinet.com,ou=eGW,dc=messinet,dc=com");)

I need to have the uid of the binding user be matched to the cn of the tree 
root for personal contacts.

How would I allow access by the bind user of:
"uid=example_user,ou=accounts,ou=messinet.com,ou=eGW,dc=messinet,dc=com"
to the entry and subentries of:
cn=example_user,ou=personal,ou=contacts,ou=messinet.com,ou=eGW,dc=messinet,dc=com"

References to the suggested ACLs (for OL) are here:
http://svn.egroupware.org/egroupware/trunk/addressbook/doc/README
http://svn.egroupware.org/egroupware/trunk/addressbook/doc/acl_addressbook.conf
http://svn.egroupware.org/egroupware/trunk/phpgwapi/doc/ldap/acl_egw_addressbook.conf


Thank you very much in advance for your assistance.

-- 
Anthony - http://messinet.com - http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20090725/32c726e5/attachment.sig>