Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to write an access control for OpenLDAP to allow a user to search with a certain base dn, but only get results back from certain sub dn's. I've played with lots of different rules but cant get it to work. I'm not sure its even possible.

For example:
I have the user with the dn uid=testuser,ou=people,dc=example,dc=com. I want this user to be able to search with a base of dc=example,dc=com and get back entries in ou=people,dc=example,dc=com. There are lots of other sub OUs under dc=example,dc=com, but only entries in ou=people should be returned (for bonus, I'd only like certain attributes to be returned as well).

Can this be done?

share|improve this question
up vote 0 down vote accepted

Finally figured this out. There are lots of different parts to this to make it work.

First the 2 ACL rules:

Access to dn.base="dc=example,dc=com" by \
  dn.base="uid=testuser,ou=people,dc=example,dc=com" \

Access to"ou=people,dc=example,dc=com" \
  attrs=entry,uid,cn,sn,gecos,mail,uidNumber,gidNumber by \
  dn.base="uid=testuser,ou=people,dc=example,dc=com" \
  • Order of the rules does not matter because we are using dn.base on the 'access to' for the first rule. If it were 'dn.children', order would matter.
  • The first rule grants uid=testuser search access to dc=example,dc=com, but absolutely nothing more. Without the second rule all that would come back was whether the search matched anything or not, not what it did match.
  • The second rule grants uid=testuser read access to ou=people and the children one level deep ( Search ability is included in the read permission.
  • The entry attr is important on the second rule as performing a search requires access to this attr to be able to match the entry.
  • Once the entry is matched, the search will come back with all the other attributes that were permitted.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.