Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create couple of Admin users who have access to create/delete users on a particular group/Organization Unit. For example,

User: uid=testadmin, ou=people, dc=my,dc=net

Should have access to create new users/delete users under

ou=People,dc=my,dc=net

I tried with below ACI but did not work

(target = "ldap:///ou=People,dc=my,dc=net")(targetattr = "*") (version 3.0;acl "testadmin Permissions";allow (proxy)(userdn = "ldap:///uid=testadmin,ou=people,dc=my,dc=net");)

I am able to add administrative users from the Directory Server console, but this user data is not stored in ldif files and only stored in binary database at /var/lib/dirsrv/slap-ldap/db/. Only problem is these users have full power and I am not sure how to restrict their access.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Well Answer turn to be very simple and logical. In order to provide an ACI for a specific OU. In this case, the user sm has all rights under the directory ou=Support Group.

 (targetattr = "*") 
(target = "ldap:///ou=Support Group,dc=my,dc=net") 
(version 3.0;
acl "sm aci";
allow (all)
(userdn = "ldap:///uid=sm,ou=Support Group,dc=my,dc=net")
;)

target: specifies where to apply the rule.

targetattr: Could be used to limit the access to various attributes of the entry. Such as you the "sm" user not to have access to change password such thing you could specify here.

allow (): specifies the permission

the last one userdn (Bind Rule): Specifies who has the rights. In this way you can easily give away access to other users to manage their own groups User credentials.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.