0

I work with CentOS7 and I am configuring OpenLDAP base. I have root administrator (ldapadmin) who can make changes in the entire base (in all branches). I create branches for departments, that have to contain users and 1 or 2 administrators just for that branch, who can add users and modify all their informations and see all entities from that branch. Administrator from one branch should not make changes or see users from different branches. Users can only see all informations about them and modify their informations such as email, display name and password.

I create group for admins of that branch in each branch (groupOfNames).

Please can anyone help me write ACL in OpenLDAP that can perform these? I have trying to write ACL for weeks and still I did not find a solution. Thank you for your time. All the best!

PS. My base look like in the picture.

enter image description here

Here is my idea, that I tried (didn't work out):

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadmin,dc=example,dc=com" read by * none
olcAccess: {1}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {2}to attrs=shadowLastChange by self write by self read by * none
olcAccess: {3}to dn.subtree="dc=department1,dc=example,dc=com" by self write by anonymous auth by group/groupOfNames/member="cn=admin,ou=Groups,dc=department1,dc=example,dc=com" manage by * none 
olcAccess: {4}to dn.subtree="dc=department2,dc=example,dc=com" by self write by anonymous auth by group/groupOfNames/member="cn=admin,ou=Groups,dc=department2,dc=example,dc=com" manage by * none 
olcAccess: {5}to * by self read by * search
New contributor
Angy is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Angy is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.