access control policy in slapd.conf

niraj.kumar · 05-05-2009, 06:57 AM

How can i set access control policy in smbopenldap's slapd.conf file
so that a user login using myphpldapadim only can see his own property, not others. I have tried the following in slapd.conf file :-

access to dn.base="cn=Manager,dc=mydomain,dc=com"
by self write
by self read

when using the above parameter, user login using phpmyldapadmin
but can see others users property also(unable to write others).

it is possible that he can only read and write his own not to others?

Thanks,

Niraj Kumar.

archangel_617b · 05-05-2009, 01:04 PM

I have an ACL in my slapd.conf that looks like this:

Code:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by * read

Changing the line "by * read" to "by * none" should help. You may be better of just restricting specific attributes instead, however, or else making sure that you've got some account that can be used for read-only access to everything.

For restricting specific attributes, look at your access list for the password field:

Code:

access to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by anonymous auth
        by self write
        by * none

And for a read-only user, it should look something like this:

Code:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by dn="cn=readonly,dc=dl,dc=example,dc=com" read
        by * none

- Arch

archangel_617b · 05-05-2009, 01:08 PM

Quote:

Originally Posted by niraj.kumar

Code:

 access to dn.base="cn=Manager,dc=mydomain,dc=com"
        by self write
        by self read

But maybe just adding "by * none" and the end of that ACL will do what you want?

Sorry, I'm not exactly an expert in building ACLs for slapd but I hope this helps.

- Arch

niraj.kumar · 05-06-2009, 06:58 AM

Quote:

Originally Posted by archangel_617b

I have an ACL in my slapd.conf that looks like this:

Code:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by * read

Changing the line "by * read" to "by * none" should help. You may be better of just restricting specific attributes instead, however, or else making sure that you've got some account that can be used for read-only access to everything.

For restricting specific attributes, look at your access list for the password field:

Code:

access to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by anonymous auth
        by self write
        by * none

And for a read-only user, it should look something like this:

Code:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=dl,dc=example,dc=com" write
        by dn="cn=readonly,dc=dl,dc=example,dc=com" read
        by * none

- Arch

Many Many Thanks for your nice reply.

Niraj