On 03/06/2013 09:59 PM, Jon Detert wrote:
Ludwig,
----- Original Message -----
From: "Ludwig Krispenz" <lkrispen@xxxxxxxxxx>
To: 389-users@xxxxxxxxxxxxxxxxxxxxxxx
Sent: Wednesday, March 6, 2013 12:49:26 PM
Subject: Re: How can I grant read access to the attributes of a nsDS5ReplicationAgreement object?
On 03/06/2013 06:49 PM, Jon Detert wrote:
I want to check the status of replication agreements, but I don't
want to use the directory manager's credentials to do so. I want
to use bind credentials for a dn that only has read access.
Is an ACI what I need? If so, how? I've tried several, but they
don't work as I intended.
One thing I'm uncertain of, is which dn to associate the aci
attribute with. I've tried these:
cn=config
cn=mapping tree,cn=config
dc=example,dc=com
and the actual dn of the replication agreement object.
except dc=example,dc=com all should work
I'm also not certain of the target to use in the aci. I've tried
these:
(targetfilter = "(objectClass=nsds5ReplicationAgreement)")
and
(target="ldap:///cn=*,cn=replica,cn=*,cn=mapping tree,cn=config")
both should work.
Any ideas what I'm doing wrong?
What does the complete aci look like ?
aci: (targetattr="*") (version 3.0; acl "CheckReplStatus2"; allow (read,search,compare) userdn = "ldap:///uid=jd,ou=people,dc=example,dc=com";;)
The error I get when trying to add this to the dn of the replication agreement is '(53) Unwilling to perform'.
I think the updates to the replication entries are handled by the
replication pluging and reject (some) modifications. You could place the
aci unde cn=config, the following works:
ldapmodify ......................
dn: cn=config
changetype: modify
add: aci
aci:
(targetattr="*")(targetfilter="objectclass=nsds5replicationagreement")(version
3.0; acl "access replagreement";
allow(read,search)
userdn="ldap:///cn=Mr00005,ou=People,dc=example,dc=com";;)
modifying entry "cn=config"
ldapsearch .... -D "cn=Mr00005,ou=People,dc=example,dc=com" -w password
-b "cn=config" "objectclass=nsds5replicationagreement"
dn: cn=to200,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: mm1-2
cn: to200
nsDS5ReplicaRoot: dc=example,dc=com
n
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
