Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to store ACL permissions to LDAP. I have permission for users and for groups (user belongs to many groups). Here is structure i create:

    cn=Admin [posixGroup] {memberUid=andrew, memberUid=johny}
       cn=Right {resource:ftp1, action:all}
       cn=Right {resource:ftp2, action:all}
    cn=Editor [posixGroup] {memberUid=joseph}
       cn=Right {resource:ftp1, action:list}
    cn=andrew {uid=andrew}
       cn=Right {resource:ftp3, action:all}
    cn=johny {uid=johny}
    cn=joseph {uid=joseph}

there are attributes in brackets {}. Well, in time when andrew connects to ftp3, i'd like to check permissions so i query:


but i get only parent elements of cn=Rights : cn=andrew and cn=Admin. Is it possible to write query to return cn=Right elements using filter by memberUid uid elements defined in parents? Or structure has to be changed some way. Thank you very much, for your time. Andrew

share|improve this question
up vote 0 down vote accepted

With your current schema, I believe you'd have to do two sets of queries:

  1. Use your existing query to find matching users and groups.
  2. For each of those entries found, query each to see if it has a Right entry, setting the base DN to the entry you found in step 1.

Or you could change the structure so that users and groups have multi-value right entries, perhaps something like:

cn=Admin [posixGroup] {memberUid=andrew, memberUid=johny,
                       right: ftp1/all, right: ftp2/all}
cn=Editor [posixGroup] {memberUid=joseph, right: ftp1/list}
cn=andrew {uid=andrew, right: ftp3/all}

Your query would be the same, but you'd get the right attributes in the returned set (without having to do any further queries). Or, if you know the service and permission level requested at the time you make the query, you can put that in, too:


If you get at least one result, then you know you can grant access; otherwise, deny access.

share|improve this answer
oh, i forgot, i can use more attributes with the same name in one element (big step for me, from objects in programming). It is very nice one query solution! And with pattern match on attribute value, it has all, what we need. Thank you a lot fission – andrew Jan 12 '12 at 8:13
can't +1 small reputation number :( – andrew Jan 12 '12 at 8:15
You're welcome. If you think this is the correct answer, you could accept it; that would be even better than a +1, and will give you +2, too! – fission Jan 12 '12 at 8:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.