I am trying to secure existing OpenLDAP installation where it is a requirement to allow anonymous user to retrieve information about records if it knows uid of specific user entry in LDAP. Assume structure as below:
dc=example,dc=com ou=People uid=user1 uid=user2 ou=Groups cn=user1 memberUid:user1 cn=user2 memberUid:user2 cn=common memberUid:user1 memberUid:user2
Now if anonymous know that entry uid=user1 exist in LDAP, they should be able to retrieve list of groups where this user is a member. However they should not be able to discover other groups.
ldapsearch -b "ou=Groups,dc=example,dc=com" should return nothing, while
ldapsearch -b "ou=Groups,dc=example,dc=com" "(&(objectClass=posixGroup)(memberUid=user1))" should return all groups where user1 is member.
I've tried a few different ACLs to no luck so far. It is either search is working but also can list all groups, or cannot list all groups but then search is not working.
Is there a way to achieve desired behavior using ACLs?
PS: The database uses standard nis schema, since the database already have data changing to rfc2307bis is not an option (and there are other reasons why such change is not possible in this case).