Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only.

I sure miss Active Directory... :)

share|improve this question
up vote 2 down vote accepted

By using OpenLDAP Access Control Lists. You need to put to your slapd.conf a new line similar to this under to that specific OU's slapd.conf entry:

access to dn.subtree="ou=yourou,dc=yourdomain,dc=com"
by dn.exact="cn=youradministratoruser,ou=yourou,dc=yourdomain,dc=com"
(other ACL rules go here)
share|improve this answer
I am dealing with this exact problem as well, but trying to get it managed by a group, instead of a user.. IE, cn=LocalIT,ou=yourou,dc=ourdomain,dc=com" What is the syntax to use for "any member of group LocalIT"? – Brian Jul 13 '12 at 16:48
@Brian: See section 8.4.4. Managing access with groups from here: ... group.exact is the keyword you are looking for, but the tutorial has some more details for you, too. – Janne Pikkarainen Jul 14 '12 at 6:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.