How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only.
I sure miss Active Directory... :)
By using OpenLDAP Access Control Lists. You need to put to your slapd.conf
a new line similar to this under to that specific OU's slapd.conf entry:
access to dn.subtree="ou=yourou,dc=yourdomain,dc=com"
by dn.exact="cn=youradministratoruser,ou=yourou,dc=yourdomain,dc=com"
(other ACL rules go here)
8.4.4. Managing access with groups
from here: openldap.org/doc/admin24/access-control.html ... group.exact
is the keyword you are looking for, but the tutorial has some more details for you, too.
Jul 14, 2012 at 6:25