Hello, firstly, thanks for 389! I have just migrated my small domain from OL
to 389 DS including some basic replication and have found it to be a solid,
reliable and quick system.
I am however having a lot of confusion with ACIs. I am trying to create ACIs
with the same specificity that I had with OL and eGroupWare
(
http://egroupware.org), but can't seem to get one of them figured out.
This is what I'm trying to accomplish (in OL format):
access to
dn.regex="^ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
attrs=children
by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
by * none
access to
dn.regex="^cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
attrs=entry
by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
by
dn.exact,expand="uid=$1,ou=accounts,ou=$2,o=eGroupWare,dc=messinet,dc=com"
read
by * none
access to
dn.regex="cn=([^,]+),ou=personal,ou=contacts,ou=([^,]+),o=eGroupWare,dc=messinet,dc=com$"
by dn.exact="uid=egwadmin,o=eGroupWare,dc=messinet,dc=com" write
by
dn.exact,expand="uid=$1,ou=accounts,ou=$2,o=eGroupWare,dc=messinet,dc=com"
write
by * none
I have tried using the following in 389 DS to no avail.
On the ou=messinet.com,ou=eGW,dc=messinet,dc=com entry...
(targetattr = "*") (target =
"ldap:///cn=($dn),ou=personal,ou=contacts,ou=messinet.com,ou=eGW,dc=messinet,dc=com")
(version 3.0;acl "eGW personal addressbook access";allow
(read,compare,search,write,delete,add)(userdn =
"ldap:///uid=($dn),ou=accounts,ou=messinet.com,ou=eGW,dc=messinet,dc=com");)
I need to have the uid of the binding user be matched to the cn of the tree
root for personal contacts.
How would I allow access by the bind user of:
"uid=example_user,ou=accounts,ou=messinet.com,ou=eGW,dc=messinet,dc=com"
to the entry and subentries of:
cn=example_user,ou=personal,ou=contacts,ou=messinet.com,ou=eGW,dc=messinet,dc=com"
References to the suggested ACLs (for OL) are here:
http://svn.egroupware.org/egroupware/trunk/addressbook/doc/README
http://svn.egroupware.org/egroupware/trunk/addressbook/doc/acl_addressboo...
http://svn.egroupware.org/egroupware/trunk/phpgwapi/doc/ldap/acl_egw_addr...
Thank you very much in advance for your assistance.
--
Anthony -
http://messinet.com -
http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E