Hello, all. We are still refining how we want to deploy 389 in a
multi-tenant environment. To grant access to the admins for each tenant
to manage their own external contact lists, we created an ACI as
follows:
(targetattr = "*") (target = "ldap:///($dn),o=external,dc=ssiservices,
dc=biz") (version 3.0;acl "Client Administrators External";allow
(all)(groupdn =
"ldap:///cn=*ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz");)
Each tenant has a client number which is prefixed to the ldapadmins
group cn so that we don't have thousands of groups with the same cn so,
for example, c001ldapadmins, c002ldapadmins. Hence the * in the cn.
However, it does not seem to work. Client admins are told they do not
have rights to add new objects. If we replace the * with the prefix,
e.g.,
"ldap:///cn=c001ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz"),
it works fine. Is there a way to use wildcards in a groupdn? The literature explicitly
says so for userdn but not groupdn. Thanks - John
PS - I first tried sending this to 389-users but that mail bounced -
John
--
John A. Sullivan III
Open Source Development Corporation
Street Preacher: Are you SAVED?????!!!!!!
Educated Skeptic: Saved from WHAT?????!!!!!!
Educated Believer: From our selfishness that hurts the ones we love
and condemns us to an eternity of hurting each other.
http://www.spiritualoutreach.com
Christianity that makes sense