3

I am trying to secure existing OpenLDAP installation where it is a requirement to allow anonymous user to retrieve information about records if it knows uid of specific user entry in LDAP. Assume structure as below:

dc=example,dc=com
  ou=People
    uid=user1
    uid=user2
  ou=Groups
    cn=user1
      memberUid:user1
    cn=user2
      memberUid:user2
    cn=common
      memberUid:user1
      memberUid:user2

Now if anonymous know that entry uid=user1 exist in LDAP, they should be able to retrieve list of groups where this user is a member. However they should not be able to discover other groups.

Thus ldapsearch -b "ou=Groups,dc=example,dc=com" should return nothing, while ldapsearch -b "ou=Groups,dc=example,dc=com" "(&(objectClass=posixGroup)(memberUid=user1))" should return all groups where user1 is member.

I've tried a few different ACLs to no luck so far. It is either search is working but also can list all groups, or cannot list all groups but then search is not working.

Is there a way to achieve desired behavior using ACLs?

PS: The database uses standard nis schema, since the database already have data changing to rfc2307bis is not an option (and there are other reasons why such change is not possible in this case).

Improve this question
2

I don't think this is possible this way around, as you couldn't restrict which groups can be read. However, OpenLDAP offers an alternative way that might help you. This is called "Reverse Group Maintenance" (see Chapter 12.8 in the (outdated) docs) with the memberOf overlay. Basically, it maintains a list of every group a user is member of, which allows for easy lookups of this type of information.

For help how to do this the modern way, with cn=config, look here.

Improve this answer
4
  • Please see PS in the question, while I agree overlay could solve this, but this means using rfc2307bis, which means I would need to migrate entire DB to new schema (over 1k entries there). And moreover not all client applications work with rfc2307bis. – Alexey Kamenskiy Sep 14 '17 at 6:49
  • Moreover rfc2307bis is not a standard in any way, it was a proposal for standard, but the proposal has expired over 7 years ago (and it was never accepted). Which is exactly a reason why many client apps are not supporting this schema. – Alexey Kamenskiy Sep 14 '17 at 6:50
  • I guess then you are out of luck. – Sven Sep 14 '17 at 6:50
  • Actually (very interesting), I can restrict that requester cannot get full list of children using ACL (such as to dn.children="ou=People" by anonymous read followed by to * by anonymous none. Then anon has to know exact uid to request information. But this approach does not seem to work well with any search combinations. – Alexey Kamenskiy Sep 14 '17 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.