0

Does anyone know why when I add these 3 ACLs the third is represented in the olcDatabase\={2}hdb.ldif as a random string?

ACLs:

olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=eastlands,dc=net" write
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=server,dc=net" write by * read

slapcat output:

olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=server,dc=net" write
olcAccess: {1}to dn.base="" by * read
olcAccess:: ezJ9dG8gKiBieSBkbj0iY249TWFuYWdlcixkYz1lYXN0bGFuZHMsZGM9bmV0IiB3cml0ZSBieSAqIHJlYWQg

This is kind of random but it's really bugging me.

I'm running openldap-2.4.39-7.el7 on CentOS 7.

1
  • This is the base64 encoding of the string. AFAIK OpenLDAP uses it if runs into some special characters that it thinks are part of the string (eg. CR or LF).
    – Sven
    Nov 14, 2015 at 17:51

2 Answers 2

2

Please try:

echo "your_hash" | openssl enc -d -base64

you will see what is inside the hash. You can confirm what @Sven said (a trailing space at the end of the line, very likely).

0

I made this simple script to do that: https://github.com/peppelinux/slapd_acl

just install it with pip3 install slapd_acl It will show us the ACL in plaintext if they are in b64. It can also export them in a ldap modify ldif structure, to let us to modify them easily and submit soon after.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .