So I'm trying to get some ACIs added to my OpenLDAP system (hosting on CentOS 6). I've read how others put their ACIs in bdb like so...

olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=manager,dc=bromosapien,dc=net" write by * read

However, I want to avoid that and just allow the password changes to happen from a container (and at least avoid using Directory manager). I read someone doing this which works from their perspective:

dn: ou=People,dc=bromosapien,dc=net
changetype: modify
add: aci
aci: (targetattr = "userpassword || telephonenumber")(version 3.0; acl "Allow self entry modification"; allow (write)(userdn = "ldap:///self");)

Problem is, trying to add it, I get this.

# ldapadd -xWD "cn=manager,dc=bromosapien,dc=net" -f aci-password.ldif 
Enter LDAP Password: 
modifying entry "ou=People,dc=bromosapien,dc=net"
ldap_modify: Undefined attribute type (17)
        additional info: aci: attribute type undefined

I must be doing something wrong or mentioning a wrong objectclass, etc. The question is, should I really be doing everything in bdb.ldif or is this possible to add ACIs that way and whatever method is "recommended" in this case, what's a better way to provide the ACIs I need to allow a user to change their own password (without the need of the directory manager)?

Edit: I also noticed with the olcAccess lines, ldapsearch doesn't show the userPassword line from an anonymous search.

  • You need an empty line before each line starting with "dn:" LDIF separates entries by blank lines. dn: denotes the distinguished name of an entry and needs to be the first line of each entry. – user181870 Jul 16 '13 at 22:23

Figured out that it's probably better to just do it the bdb.ldif way. What I did was like the above, but I made a few changes.

olcAccess: {0}to attrs=userPassword,shadowLastChange,loginShell by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=manager,dc=bromosapien,dc=net" write by group.exact="cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net" write by * read

What I did instead was, I labeled each line with braces and a number. I also added the ability for a user to change their login shell (because I allow Bash, ksh, and zsh, we default to bash). I then created a groupOfNames container inside of the Group OU. Like this.

dn: cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net
objectClass: groupOfNames
objectClass: top
member: uid=zera,ou=People,dc=angelsofclockwork,dc=net
member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net

Of course, this requires the memberOf overlay.

The memberOf overlay I used is below:

% vi modules.ldif

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: memberof

% vi memberof.ldif

dn: olcOverlay=memberof,olcDatabase={2}bdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.