This question is similiar to this one, however, I am trying to delegate based off of either group of unique names, or posixGroup group.
Basically,
I have a group: cn=support,ou=group,dc=example,dc=com
I have an OU that I would like them to be able to create new users, reset passwords, etc:
ou=clientUsers,ou=People,dc=example,dc=com
I want the people in the support group, to be able to add new customers to anyone in the clientUsers ou.
I am trying to add the rules directly into the cn=config database, and am struggling with the syntax. I can delegate a user easily, and it works well, but I would like to delegate any member of the group. (makes administration much, much simpler than 30 ACL lines for all the different support people) I have tried several different rules, and several types of groups, but am having no luck. This is the value for the oclAccess attribute I am trying
{2}to dn.subtree="ou=clientUsers,ou=People,dc=example,dc=com" by group/posixGroup/memberUid="cn=support,ou=group,dc=example,dc=com" write
{2}to dn.subtree="ou=clientUsers,ou=People,dc=example,dc=com" by group.exact="cn=support,ou=group,dc=example,dc=com" write
etc
I am trying to use ldap-account-manager (pro) to make it so they can log into the easy web interface, and add users and groups. So from what I have seen, that means I need to use either posixGroups or groupsOfUniqueNames.
Any ideas on how to word my oclaccess line?
