1

How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only.

I sure miss Active Directory... :)

1 Answer 1

2

By using OpenLDAP Access Control Lists. You need to put to your slapd.conf a new line similar to this under to that specific OU's slapd.conf entry:

access to dn.subtree="ou=yourou,dc=yourdomain,dc=com"
by dn.exact="cn=youradministratoruser,ou=yourou,dc=yourdomain,dc=com"
(other ACL rules go here)
2
  • I am dealing with this exact problem as well, but trying to get it managed by a group, instead of a user.. IE, cn=LocalIT,ou=yourou,dc=ourdomain,dc=com" What is the syntax to use for "any member of group LocalIT"?
    – Brian
    Jul 13, 2012 at 16:48
  • 1
    @Brian: See section 8.4.4. Managing access with groups from here: openldap.org/doc/admin24/access-control.html ... group.exact is the keyword you are looking for, but the tutorial has some more details for you, too. Jul 14, 2012 at 6:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .