1

Our openldap has multiple groups: useradmins, agt, ib, iss, itt

The "useradmins" group has always had permissions to edit (write) to all of the groups. I recently performed a simple 'yum update' and openldap was updated. Since that time (about 3 days ago now) admins cannot write (add or change users). The error is:

Insufficient access - no write access to parent

...or, depending upon my trial/error with the slapd.conf file, sometimes I simple get:

Insufficient access

I have edited my slapd.conf file (about 500 times) trying different settings while reading online posts, docs, etc. My current slapd.conf file looks like this:

...
database        bdb
suffix          "dc=am5up,dc=com"
directory       /var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber               eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index entryCSN                          eq
index entryUUID                         eq

access to *
          by self write
          by dn="cn=admin,dc=am5up,dc=com" write
          by group/groupOfUniqueNames/uniqueMember="cn=useradmins,ou=groups,dc=am5up,dc=com" write
          by * read
rootdn    "cn=admin,dc=am5up,dc=com"
rootpw    <hashed pwd>
...

My assumption is this line is wrong:

group/groupOfUniqueNames/uniqueMember="cn=useradmins,ou=groups,dc=am5up,dc=com" write

...but I have tried dozens of variations without success.

Can anyone make any suggestions?

Much appreciated.

  • Please post the contents of group dn "cn=useradmins,ou=groups,dc=am5up,dc=com" also? – Anirudh Malhotra Oct 29 '16 at 3:23
  • Anirudh, is this what you are wanting? dn: cn=useradmins,ou=groups,dc=am5up,dc=com cn: useradmins gidnumber: 10001 memberuid: mscot memberuid: nhman memberuid: taden memberuid: japid objectclass: posixGroup – MSF004 Oct 29 '16 at 12:33
1

So, According to the comment the group is as follows:

dn: cn=useradmins,ou=group,dc=am5up,dc=com

cn: useradmins

gidnumber: 10001

memberuid: mscot

objectclass: posixGroup

memberuid: nhman

memberuid: taden

memberuid: japid

but according to acl:

by group/groupOfUniqueNames/uniqueMember="cn=useradmins,ou=groups,dc=am5up,dc=com" write

The group should have objectClass groupOfUniqueNames and uniqueMember(whoever you want to grant access to). But the group as shown above doesn't have any, So you can do two things now:

  • Add objectClass groupOfUniqueNames and its members uniqueMember, the ACL will work surely.

OR

  • After doing some research I found posixGroup has syntax like this only, You can use to grant access to posixGroup members. You have to do something like:
access to *
           whatever you want
           by set="user/uid & [cn=useradmins]/memberuid" write
           by * none

For "user/uid" this will be applicable if the memberuids are the actual uid of members, otherwise put whatever attribute you are using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.