Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I'm trying to get some ACI's added to my OpenLDAP system (hosting on CentOS 6). I've read how others put their ACI's in bdb like so...

olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=manager,dc=bromosapien,dc=net" write by * read

However, I want to avoid that and just allow the password changes to happen from a container (and at least avoid using Directory manager). I read someone doing this which works from their perspective:

dn: ou=People,dc=bromosapien,dc=net
changetype: modify
add: aci
aci: (targetattr = "userpassword || telephonenumber")(version 3.0; acl "Allow self entry modification"; allow (write)(userdn = "ldap:///self");)

Problem is, trying to add it, I get this.

# ldapadd -xWD "cn=manager,dc=bromosapien,dc=net" -f aci-password.ldif 
Enter LDAP Password: 
modifying entry "ou=People,dc=bromosapien,dc=net"
ldap_modify: Undefined attribute type (17)
        additional info: aci: attribute type undefined

I must be doing something wrong or mentioning a wrong objectclass, etc. The question is, should I really be doing everything in bdb.ldif or is this possible to add ACI's that way and whatever method is "recommended" in this case, what's a better way to provide the ACI's I need to allow a user to change their own password (without the need of the directory manager)?

Edit: I also noticed with the olcAccess lines, ldapsearch doesn't show the userPassword line from an anonymous search.

share|improve this question
You need an empty line before each line starting with "dn:" LDIF separates entries by blank lines. dn: denotes the distinguished name of an entry and needs to be the first line of each entry. –  remyabel Jul 16 '13 at 22:23

1 Answer 1

Figured out that it's probably better to just do it the bdb.ldif way. What I did was like the above, but I made a few changes.

olcAccess: {0}to attrs=userPassword,shadowLastChange,loginShell by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=manager,dc=bromosapien,dc=net" write by group.exact="cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net" write by * read

What I did instead was, I labeled each line with braces and a number. I also added the ability for a user to change their login shell (because I allow Bash, ksh, and zsh, we default to bash). I then created a groupOfNames container inside of the Group OU. Like this.

dn: cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net
objectClass: groupOfNames
objectClass: top
member: uid=zera,ou=People,dc=angelsofclockwork,dc=net
member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net

Of course, this requires the memberOf overlay.

The memberOf overlay I used is below:

% vi modules.ldif

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: memberof

% vi memberof.ldif

dn: olcOverlay=memberof,olcDatabase={2}bdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.