Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following openldap server configuration:

access to attrs=userPassword
    by self write
    by anonymous auth
    by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
    by * none

# Allow everybody adding and changing Contacts
access to dn.subtree="ou=Contacts,dc=my-company,dc=de"
    by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write 
    by * read

access to *
    by self write
    by dn.base="cn=admin,dc=my-company,dc=de" write
    by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
    by * read

What it should do is this:

  1. allow everybody to change his own password
  2. allow all users to add and change contacts
  3. allow all in group "sysadm" to change everything

The problem is, the sysadms can not change any user password. Any hints?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

Quoting the OpenLDAP admin guide:

The order of evaluation of access directives makes their placement in the configuration file important. If one access directive is more specific than another in terms of the entries it selects, it should appear first in the config file. Similarly, if one selector is more specific than another it should come first in the access directive.

To cut long story short, try the following:

access to attrs=userPassword
    by dn.base="cn=admin,dc=my-company,dc=de" write
    by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
    by self write
    by anonymous auth
    by * none

# Allow everybody adding and changing Contacts
access to dn.subtree="ou=Contacts,dc=my-company,dc=de"
    by dn.base="cn=admin,dc=my-company,dc=de" write
    by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
    by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write 
    by * read

access to *
    by dn.base="cn=admin,dc=my-company,dc=de" write
    by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
    by self write
    by * read

BTW, do you really want to grant all users access to all attributes of their own object ('access to * ... by self write')? As you're limiting write access to the userPassword attribute only in the first ACL, I'd say that it's not what you wanted.

share|improve this answer

What happens if you do this?

access to dn.subtree"[cn=users,ou=Group,dc=my-company,dc=de]"
by self write
by dn.base="cn=admin,dc=my-company,dc=de" write
by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
by * read
share|improve this answer
1  
The only difference is using a dn.subtree instead of *, right? Why should this work better? I'll give it a try, when I'm back in this project, what could take some days. –  Tim Büthe Oct 13 '09 at 10:30

IIRC slapd uses the first matching rule. Since the first block matches userPassword but doesn't allow sysadmins to modify, they aren't allowed to modify.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.