0

I have an OpenLDAP 2.4 setup with multiple DITs. Each DIT database has a RootDN with manage rights, as it should. I need to give manage rights [or at least write] to either cn=config, or LDAPI so that there would be OpenLDAP "root" able to manage both config database, as well as individual DIT databases.

I have tried various olcAccess configurations, and nothing worked. Basically, I tried two general approaches - messing config ACLs as well as adding cn=config to individual DITs ACLs as below:

olcAccess: {0}to attrs=userPassword,shadowLastChange
  by self write
  by anonymous auth
  by dn="cn=admin,dc=ldap,dc=com" write
  by dn="cn=config" write
  by * none
olcAccess: {1}to dn.base=""
  by * read
olcAccess: {2}to *
  by self write
  by dn="cn=admin,dc=ldap,dc=com" write
  by * read

Nothing has worked so far. I have been stuck on this for a while.

  • Why do people who have never used written an OpenLDAP configuration script have the audacity to edit one thinking that they are improving someone's post? – Moshe Shmukler Mar 30 '15 at 13:01
  • 2
    The edit, unlike your statement, is totally legitimate. – dawud Mar 30 '15 at 21:34
  • In my distraction I actually did screwed up the line folding as presented by SF display layer, sorry. w3.org/2002/12/cal/rfc2425#sec5.8.1. – 84104 Apr 10 '15 at 1:56
1
olcAccess: {2}to * by self write by dn="cn=admin,dc=ldap,dc=com" write by dn="cn=config" write by * read
  • 2
    Try adding some explanation of what this does, and why it solves your problem. – dawud Mar 30 '15 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.