Working on OpenLDAP:

ldapsearch: @(#) $OpenLDAP: ldapsearch  (Ubuntu) (May 11 2016 16:11:48) $
    (LDAP library: OpenLDAP 20442)

I have working SSH auth using public keys stored in LDAP directory.

I want to create an user that only can to search on attributes destinationIndicator and sshPublicKey.

LDAP wrapper script is


ldapsearch \
    -D "uid=auth-ssh,ou=ReadOnlyUsers,dc=example,dc=com" \
    -b "ou=Users,dc=example,dc=com" \
    -w "Password" \
    '(&(objectClass=ssh)(destinationIndicator='"$1"'))' 'sshPublicKey' | sed -n '/^ /{H;d;};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'

I want to limit the "uid=auth-ssh,ou=ReadOnlyUsers,dc=example,dc=com" users permissions to ask only for destinationIndicator and sshPublicKey into the "ou=Users,dc=example,dc=com" group.

It is possible? Thanks.

  • 2
    Possible? Most likely. But since you don't name your LDAP server, we can't tell for sure... As an example, read openldap.org/doc/admin24/access-control.html – Sven Apr 12 '17 at 11:07
  • Access control to attributes is governed by the LDAP directory server, which you don't mention. – HBruijn Apr 12 '17 at 11:08
  • Sorry, question edited to add LDAP version. – Lito Apr 12 '17 at 11:16
  • i don't know if ACIs exist on OpenLDAP, but Sun LDAP, we use what we call ACI's,it's just a small policy where you can say for example "for this DN, give the permissions Search,Update on this DN on attributes X Y Z", i would be suprised if OpenLDAP didn't have a similar feature. it should fit your needs perfectly, and it's just 1 ACI to be created (it's easy to do) – olivierg May 29 '17 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.