2

We have an OpenLDAP (2.4.45) server that contains all of our users, groups, sudo rules etc.

I need to connect new application to this server, however this application requires that anonymous user can read attributes (it will know the exact DN for which it needs to read attributes).

Now assuming structure as:

o=Example(dc=example,dc=com)
  ou=People
    uid=user1
    uid=user2
  ou=Groups
    cn=group1
    cn=group2

I need to limit that anonymous users can get all attributes of a user if they know exact dn (such as dn="uid=user1,ou=People,dc=example,dc=com") and completely unable to discover other records (if they don't know the exact dn to them).

Reading through OpenLDAP documentation I assumed the following ACL should work:

olcAccess: {0}to dn.children="ou=Groups,dc=example,dc=com"
  by * read break
olcAccess: {1}to *
  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  by anonymous none stop
  by * read

However it seems break and stop do not produce expect results as queries directly to "cn=test,ou=Groups,dc=example,dc=com" result in No such object (32)

What is the correct way to achieve the above?

1

Actually the answer was rather simple (pointed to this in IRC):

The ACL should be as:

olcAccess: {0}to dn.children="ou=Groups,dc=example,dc=com"
  by anonymous stop
  by * read break
olcAccess: {1}to *
  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  by anonymous none stop
  by * read

Note the stop line in {0}, in original ACL it first gives read access, but then removes it because of break, in new version, the anonymous explicitly granted read access and then OpenLDAP told to stop processing ACLs for this request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.