On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: > I have users personal address books as an ou under their accounts... > > ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com > > but when I try to add an entry, I am blocked... > > [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD > dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" > [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 > nentries=0 etime=0 > > I need an ACi that allows each uid account to read/write entries in OU's > under their own accounts and the only ACi's I have are the ones > inherited ---- It would be great if I could get some help here. I know that in OpenLDAP, ACL's are processed top down and so I'm looking at the ACi's that would govern here. dc=example,dc=com has the following ACI (the second one after anonymous access)... (targetattr = "carLicense ||description ||displayName ||facsimileTelephoneNumber ||homePhone ||homePostalAddress ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo ||postOfficeBox ||postalAddress ||postalCode ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber ||telexNumber ||title ||userCertificate ||userPassword ||userSMIMECertificate ||x500UniqueIdentifier") (version 3.0; acl "Enable self write for common attributes"; allow (write) (userdn = "ldap:///self";) ;) and I added one more (it's on the bottom of the list - #7)... (targetattr = "*") (version 3.0;acl "Personal Address Books";allow (write)(userdn = "ldap:///self";);) but still... [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" method=128 version=3 [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com" [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105 nentries=0 etime=0 Craig
