Hi,
389-ds has an access control mechanism which allows fine grained access
to entries, attributes for different types of operation and based on
various criteria like d,n group membership, role,.... and you should get
familiar with the basics before just adding specific acis:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
for your specific request you could do something like:
dn: l=kranj,c=si
aci: (targetattr = "*")(version 3.0; acl "Admin rights"; allow( all )
userdn = "ldap:///uid=mnadmin,ou=user,l=Kranj,c=si";)
not that in 389-ds acis have to be placed at the top of the subtree they
should apply
Ludwig
On 06/22/2017 12:31 PM, Kalan Blaz wrote:
Hi Mark,
Thank you very much for your help. Now I hit to another problem and
maybe you can help me. At OpenLDAP we have two “super users” which has
read/write/delete access for whole tree. Now in 389 DS I can do
changes or view the data only if I am login as cn=directory manager.
All my “super users” are already in 389 DS database, but I do not know
how to set them proper rights. Here is an example with ldapsearch:
ldapsearch -D "cn=directory manager" -w iskratel -b "l=kranj,c=si" -p
1317 -h kalanvm1.csi.iskratel.mak | grep numResponses
# numResponses: 108
ldapsearch -D "uid=mnadmin,ou=user,l=Kranj,c=si" -w mzPLlgQ3 -b
"l=kranj,c=si" -p 1317 -h kalanvm1.csi.iskratel.mak | grep numResponses
# numResponses: 1
So my question here is, what I must do, that user mnadmin have r/w/d
permissions and will see the same tree as directory manager does?
Best regards,
Blaz
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
--
Red Hat GmbH,
http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, Eric
Shander