Rich Megginson wrote: > Craig White wrote: >> On Thu, 2008-08-28 at 13:53 -0700, Craig White wrote: >> >>> I have users personal address books as an ou under their accounts... >>> >>> ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com >>> >>> but when I try to add an entry, I am blocked... >>> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 ADD >>> dn="cn=Test,ou=AddressBook,uid=craig,ou=People,ou=Accounts,dc=example,dc=com" >>> >>> [28/Aug/2008:12:42:11 -0700] conn=18613 op=1 RESULT err=50 tag=105 >>> nentries=0 etime=0 >>> >>> I need an ACi that allows each uid account to read/write entries in >>> OU's >>> under their own accounts and the only ACi's I have are the ones >>> inherited >>> >> ---- >> It would be great if I could get some help here. >> > The ACL Summary error log level can provide some clues. > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting >> I know that in OpenLDAP, ACL's are processed top down and so I'm looking >> at the ACi's that would govern here. >> >> dc=example,dc=com has the following ACI (the second one after anonymous >> access)... >> >> (targetattr = "carLicense ||description ||displayName >> ||facsimileTelephoneNumber ||homePhone ||homePostalAddress >> ||initials ||jpegPhoto ||labeledURL ||mail ||mobile ||pager ||photo >> ||postOfficeBox ||postalAddress ||postalCode >> ||preferredDeliveryMethod ||preferredLanguage ||registeredAddress >> ||roomNumber ||secretary ||seeAlso ||st ||street ||telephoneNumber >> ||telexNumber ||title ||userCertificate ||userPassword >> ||userSMIMECertificate ||x500UniqueIdentifier") >> (version 3.0; >> acl "Enable self write for common attributes"; >> allow (write) >> (userdn = "ldap:///self";) >> ;) >> >> and I added one more (it's on the bottom of the list - #7)... >> >> (targetattr = "*") (version 3.0;acl "Personal Address Books";allow >> (write)(userdn = "ldap:///self";);) Have you tried the "add" right, to allow users to add entries under their entries? *http://tinyurl.com/3yo88r* I'm not sure if self will work here - you might have to use a macro ACI in which the uid part of the target matches the uid part of the subject - see http://tinyurl.com/59ehxh >> >> but still... >> >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 BIND >> dn="uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" >> method=128 version=3 >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=0 RESULT err=0 tag=97 >> nentries=0 etime=0 >> dn="uid=administrator,ou=people,ou=accounts,dc=example,dc=com" >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 ADD >> dn="cn=Test,ou=AddressBook,uid=administrator,ou=People,ou=Accounts,dc=example,dc=com" >> >> [31/Aug/2008:10:27:57 -0700] conn=2625 op=1 RESULT err=50 tag=105 >> nentries=0 etime=0 >> >> Craig >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users at redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> > > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3258 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20080902/d6e9d609/attachment.bin
