Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only.

I sure miss Active Directory... :)

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

By using OpenLDAP Access Control Lists. You need to put to your slapd.conf a new line similar to this under to that specific OU's slapd.conf entry:

access to dn.subtree="ou=yourou,dc=yourdomain,dc=com"
by dn.exact="cn=youradministratoruser,ou=yourou,dc=yourdomain,dc=com"
(other ACL rules go here)
share|improve this answer
    
I am dealing with this exact problem as well, but trying to get it managed by a group, instead of a user.. IE, cn=LocalIT,ou=yourou,dc=ourdomain,dc=com" What is the syntax to use for "any member of group LocalIT"? –  Brian Jul 13 '12 at 16:48
1  
@Brian: See section 8.4.4. Managing access with groups from here: openldap.org/doc/admin24/access-control.html ... group.exact is the keyword you are looking for, but the tutorial has some more details for you, too. –  Janne Pikkarainen Jul 14 '12 at 6:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.