On 03/06/2013 09:59 PM, Jon Detert wrote:
Ludwig,
----- Original Message -----
> From: "Ludwig Krispenz" <lkrispen(a)redhat.com>
> To: 389-users(a)lists.fedoraproject.org
> Sent: Wednesday, March 6, 2013 12:49:26 PM
> Subject: Re: [389-users] How can I grant read access to the attributes of a
nsDS5ReplicationAgreement object?
>
>
> On 03/06/2013 06:49 PM, Jon Detert wrote:
>> I want to check the status of replication agreements, but I don't
>> want to use the directory manager's credentials to do so. I want
>> to use bind credentials for a dn that only has read access.
>>
>> Is an ACI what I need? If so, how? I've tried several, but they
>> don't work as I intended.
>>
>> One thing I'm uncertain of, is which dn to associate the aci
>> attribute with. I've tried these:
>>
>> cn=config
>> cn=mapping tree,cn=config
>> dc=example,dc=com
>> and the actual dn of the replication agreement object.
> except dc=example,dc=com all should work
>> I'm also not certain of the target to use in the aci. I've tried
>> these:
>>
>> (targetfilter = "(objectClass=nsds5ReplicationAgreement)")
>> and
>> (target="ldap:///cn=*,cn=replica,cn=*,cn=mapping tree,cn=config")
> both should work.
>> Any ideas what I'm doing wrong?
> What does the complete aci look like ?
aci: (targetattr="*") (version 3.0; acl "CheckReplStatus2"; allow
(read,search,compare) userdn = "ldap:///uid=jd,ou=people,dc=example,dc=com";)
The error I get when trying to add this to the dn of the replication agreement is
'(53) Unwilling to perform'.
I think the updates to the replication entries
are handled by the
replication pluging and reject (some) modifications. You could place the
aci unde cn=config, the following works:
ldapmodify ......................
dn: cn=config
changetype: modify
add: aci
aci:
(targetattr="*")(targetfilter="objectclass=nsds5replicationagreement")(version
3.0; acl "access replagreement";
allow(read,search)
userdn="ldap:///cn=Mr00005,ou=People,dc=example,dc=com";)
modifying entry "cn=config"
ldapsearch .... -D "cn=Mr00005,ou=People,dc=example,dc=com" -w password
-b "cn=config" "objectclass=nsds5replicationagreement"
dn: cn=to200,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: mm1-2
cn: to200
nsDS5ReplicaRoot: dc=example,dc=com
n
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users