Not sure if it matters but you are missing the "search" right in your allow list. Nevermind I see you tested with "all"389-Directory/1.3.1.3 B2013.193.1948
I set an ACI to specific user to add,read or modify everything on this OU:
dn: ou=UFRGS,ou=RNP,dc=homolog,dc=rnpchangetype: modifyadd: aciaci: (targetattr="*")(version 3.0;aci "ufrgs add permission";allow (add,read,write,compare) userdn="ldap:///uid=app.ufrgs.w,ou=APLICACOES,ou=RNP,dc=homolog,dc=rnp";)
Are you requesting the userpassword attribute in the ldapsearch? Can you paste the exact ldapsearch you are doing?
But when I do a ldapsearch with this user (app.ufrgs.w) on this OU I cant see the userpassword attribute.
dn: uid=teste123,ou=UFRGS,ou=RNP,dc=homolog,dc=rnpuid: teste123givenName: teste123objectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetorgpersonobjectClass: ntUsersn: testecn: teste123ntUserDomainId: teste123ntUserCreateNewAccount: truentUserDeleteAccount: true
I Also tried this kind of ACI:dn: ou=UFRGS,ou=RNP,dc=homolog,dc=rnpchangetype: modifyadd: aciaci: (targetattr="userPassword")(version 3.0;aci "ufrgs userpass permission";allow (all) userdn="ldap:///uid=app.ufrgs.w,ou=APLICACOES,ou=RNP,dc=homolog,dc=rnp";)
When I do it with "Directory Manager" I can see the userpassword attribute. What I have to do?
-- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users
-- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds@redhat.com