On 09/05/2013 10:24 AM, Alberto Viana wrote:
389-Directory/1.3.1.3 B2013.193.1948


I set an ACI to specific user to add,read or modify everything on this OU:

dn: ou=UFRGS,ou=RNP,dc=homolog,dc=rnp
changetype: modify
add: aci
aci: (targetattr="*")(version 3.0;aci "ufrgs add permission";allow (add,read,write,compare) userdn="ldap:///uid=app.ufrgs.w,ou=APLICACOES,ou=RNP,dc=homolog,dc=rnp";)
Not sure if it matters but you are missing the "search" right in your allow list.  Nevermind I see you tested with "all"

But when I do a ldapsearch with this user (app.ufrgs.w) on this OU I cant see the userpassword attribute.
Are you requesting the userpassword attribute in the ldapsearch?  Can you paste the exact ldapsearch you are doing?

Thanks,
Mark

dn: uid=teste123,ou=UFRGS,ou=RNP,dc=homolog,dc=rnp
uid: teste123
givenName: teste123
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: ntUser
sn: teste
cn: teste123
ntUserDomainId: teste123
ntUserCreateNewAccount: true
ntUserDeleteAccount: true

I Also tried this kind of ACI:
dn: ou=UFRGS,ou=RNP,dc=homolog,dc=rnp
changetype: modify
add: aci
aci: (targetattr="userPassword")(version 3.0;aci "ufrgs userpass permission";allow (all) userdn="ldap:///uid=app.ufrgs.w,ou=APLICACOES,ou=RNP,dc=homolog,dc=rnp";)


When I do it with "Directory Manager" I can see the userpassword attribute. What I have to do?


--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

-- 
Mark Reynolds
389 Development Team
Red Hat, Inc
mreynolds@redhat.com