Rich Megginson wrote:
Craig White wrote:
> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote:
>
>> I have users personal address books as an ou under their accounts...
>>
>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com
>>
>> but when I try to add an entry, I am blocked...
>>
>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD
>>
dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com"
>>
>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105
>> nentries=0 etime=0
>>
>> I need an ACi that allows each uid account to read/write entries in
>> OU's
>> under their own accounts and the only ACi's I have are the ones
>> inherited
>>
> ----
> It would be great if I could get some help here.
>
The ACL Summary error log level can provide some clues.
http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
> I know that in OpenLDAP, ACL's are processed top down and so I'm looking
> at the ACi's that would govern here.
>
> dc=example,dc=com has the following ACI (the second one after anonymous
> access)...
>
> (targetattr = "carLicense ||description ||displayName
> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress
> ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo
> ||postOfficeBox ||postalAddress ||postalCode
> ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress
> ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber
> ||telexNumber ||title ||userCertificate ||userPassword
> ||userSMIMECertificate ||x500UniqueIdentifier")
> (version 3.0;
> acl "Enable self write for common attributes";
> allow (write)
> (userdn = "ldap:///self")
> ;)
>
> and I added one more (it's on the bottom of the list - #7)...
>
> (targetattr = "*") (version 3.0;acl "Personal Address
Books";allow
> (write)(userdn = "ldap:///self");)
Have you tried the "add"
right, to allow users to add entries under
their entries?
*http://tinyurl.com/3yo88r*
I'm not sure if self will work here - you might have to use a macro ACI
in which the uid part of the target matches the uid part of the subject
- see
http://tinyurl.com/59ehxh
>
> but still...
>
> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND
> dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com"
> method=128 version=3
> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97
> nentries=0 etime=0
> dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com"
> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD
>
dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com"
>
> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105
> nentries=0 etime=0
>
> Craig
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
>
https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
------------------------------------------------------------------------
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users