So I'm trying to get some ACI's added to my OpenLDAP system (hosting on CentOS 6). I've read how others put their ACI's in bdb like so...
olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=manager,dc=bromosapien,dc=net" write by * read
However, I want to avoid that and just allow the password changes to happen from a container (and at least avoid using Directory manager). I read someone doing this which works from their perspective:
dn: ou=People,dc=bromosapien,dc=net changetype: modify add: aci aci: (targetattr = "userpassword || telephonenumber")(version 3.0; acl "Allow self entry modification"; allow (write)(userdn = "ldap:///self");)
Problem is, trying to add it, I get this.
# ldapadd -xWD "cn=manager,dc=bromosapien,dc=net" -f aci-password.ldif Enter LDAP Password: modifying entry "ou=People,dc=bromosapien,dc=net" ldap_modify: Undefined attribute type (17) additional info: aci: attribute type undefined
I must be doing something wrong or mentioning a wrong objectclass, etc. The question is, should I really be doing everything in bdb.ldif or is this possible to add ACI's that way and whatever method is "recommended" in this case, what's a better way to provide the ACI's I need to allow a user to change their own password (without the need of the directory manager)?
Edit: I also noticed with the olcAccess lines, ldapsearch doesn't show the userPassword line from an anonymous search.