I am trying to secure existing OpenLDAP installation where it is a requirement to allow anonymous user to retrieve information about records if it knows uid of specific user entry in LDAP. Assume structure as below:
dc=example,dc=com
ou=People
uid=user1
uid=user2
ou=Groups
cn=user1
memberUid:user1
cn=user2
memberUid:user2
cn=common
memberUid:user1
memberUid:user2
Now if anonymous know that entry uid=user1 exist in LDAP, they should be able to retrieve list of groups where this user is a member. However they should not be able to discover other groups.
Thus ldapsearch -b "ou=Groups,dc=example,dc=com"
should return nothing, while ldapsearch -b "ou=Groups,dc=example,dc=com" "(&(objectClass=posixGroup)(memberUid=user1))"
should return all groups where user1 is member.
I've tried a few different ACLs to no luck so far. It is either search is working but also can list all groups, or cannot list all groups but then search is not working.
Is there a way to achieve desired behavior using ACLs?
PS: The database uses standard nis schema, since the database already have data changing to rfc2307bis is not an option (and there are other reasons why such change is not possible in this case).