> On 06/02/2016 05:54 PM, Job Cacka wrote: > Do you get entries back, or no entries? I get back 222 entries. The entries are basically the contents of the directory minus the attributes. like this, but with real data and commented lines removed: dn: ou=USERS,dc=domain,dc=com dn: uid=USERID,ou=USERS,dc=domain,dc=com dn: sambaDomainName=SOMEGROUP,dc=domain,dc=com Can you > paste the access log > showing these 4 searches(including the RESULT lines)? Let me see what that contains... > /etc/dirsrv/slapd-INSTANCE/access mine is in: /var/log/dirsrv/slapd-INSTANCE/access PLEASE NOTE: I obfuscated the IP address and the domain name in the below info. ldapsearch -H ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w "pass" -b "dc=domain,dc=com" "uid=*" [02/Jun/2016:15:45:04 -0700] conn=36851 fd=67 slot=67 SSL connection from 192.168.x.y to 192.168.x.y [02/Jun/2016:15:45:04 -0700] conn=36851 SSL 256-bit AES [02/Jun/2016:15:45:04 -0700] conn=36851 op=0 BIND dn="cn=directory manager" method=128 version=3 [02/Jun/2016:15:45:04 -0700] conn=36851 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [02/Jun/2016:15:45:04 -0700] conn=36851 op=1 SRCH base="dc=domain,dc=com" scope=2 filter="(objectClass=*)" attrs="[-x] uid=*" [02/Jun/2016:15:45:04 -0700] conn=36851 op=1 RESULT err=0 tag=101 nentries=222 etime=0 notes=U [02/Jun/2016:15:45:04 -0700] conn=36851 op=2 UNBIND [02/Jun/2016:15:45:04 -0700] conn=36851 op=2 fd=67 closed - U1 ldapsearch -H ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w "pass" -b "dc=domain,dc=com" uid=USERID [02/Jun/2016:15:50:17 -0700] conn=37168 fd=91 slot=91 SSL connection from 192.168.x.y to 192.168.x.y [02/Jun/2016:15:50:17 -0700] conn=37168 SSL 256-bit AES [02/Jun/2016:15:50:17 -0700] conn=37168 op=0 BIND dn="cn=directory manager" method=128 version=3 [02/Jun/2016:15:50:17 -0700] conn=37168 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [02/Jun/2016:15:50:17 -0700] conn=37168 op=1 SRCH base="dc=domain,dc=com" scope=2 filter="(objectClass=*)" attrs="[-x] uid=USERID" [02/Jun/2016:15:50:17 -0700] conn=37168 op=1 RESULT err=0 tag=101 nentries=222 etime=0 notes=U [02/Jun/2016:15:50:17 -0700] conn=37168 op=2 UNBIND [02/Jun/2016:15:50:17 -0700] conn=37168 op=2 fd=91 closed - U1 ldapsearch -H ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w "pass" -b "dc=domain,dc=com" uid=XYZ [02/Jun/2016:15:55:46 -0700] conn=37444 fd=96 slot=96 SSL connection from 192.168.x.y to 192.168.x.y [02/Jun/2016:15:55:46 -0700] conn=37444 SSL 256-bit AES [02/Jun/2016:15:55:46 -0700] conn=37444 op=0 BIND dn="cn=directory manager" method=128 version=3 [02/Jun/2016:15:55:46 -0700] conn=37444 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [02/Jun/2016:15:55:46 -0700] conn=37444 op=1 SRCH base="dc=domain,dc=com" scope=2 filter="(objectClass=*)" attrs="[-x] uid=xyz" [02/Jun/2016:15:55:46 -0700] conn=37444 op=1 RESULT err=0 tag=101 nentries=222 etime=0 notes=U [02/Jun/2016:15:55:46 -0700] conn=37444 op=2 UNBIND [02/Jun/2016:15:55:46 -0700] conn=37444 op=2 fd=96 closed - U1 ldapsearch -H ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w "pass" -b "dc=domain,dc=com" uid=USERID,ou=USERS,dc=domain,dc=com [02/Jun/2016:16:02:34 -0700] conn=37831 fd=81 slot=81 SSL connection from 192.168.x.y to 192.168.x.y [02/Jun/2016:16:02:34 -0700] conn=37831 SSL 256-bit AES [02/Jun/2016:16:02:34 -0700] conn=37831 op=0 BIND dn="cn=directory manager" method=128 version=3 [02/Jun/2016:16:02:34 -0700] conn=37831 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [02/Jun/2016:16:02:34 -0700] conn=37831 op=1 SRCH base="dc=domain,dc=com" scope=2 filter="(objectClass=*)" attrs="[-x] uid=test2015,ou=users,dc=domain,dc=com" [02/Jun/2016:16:02:34 -0700] conn=37831 op=1 RESULT err=0 tag=101 nentries=222 etime=0 notes=U [02/Jun/2016:16:02:34 -0700] conn=37831 op=2 UNBIND [02/Jun/2016:16:02:34 -0700] conn=37831 op=2 fd=81 closed - U1 for comparison I did this search. It gives a different number of entries, and it gives only the attributes listed. ldapsearch -H ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w "pass" -b "ou=USERS,dc=domain,dc=com" uid cn entryid entrydn sambaprimarygroupsid sambasid [02/Jun/2016:16:06:06 -0700] conn=38002 fd=84 slot=84 SSL connection from 192.168.x.y to 192.168.x.y [02/Jun/2016:16:06:06 -0700] conn=38002 SSL 256-bit AES [02/Jun/2016:16:06:06 -0700] conn=38002 op=0 BIND dn="cn=directory manager" method=128 version=3 [02/Jun/2016:16:06:06 -0700] conn=38002 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [02/Jun/2016:16:06:06 -0700] conn=38002 op=1 SRCH base="ou=USERS,dc=domain,dc=com" scope=2 filter="(objectClass=*)" attrs="[-x] uid cn entryid entrydn sambaPrimaryGroupSID sambaSID" [02/Jun/2016:16:06:06 -0700] conn=38002 op=1 RESULT err=0 tag=101 nentries=188 etime=0 notes=U [02/Jun/2016:16:06:06 -0700] conn=38002 op=2 UNBIND [02/Jun/2016:16:06:06 -0700] conn=38002 op=2 fd=84 closed - U1 > Yeah, it is a bit to digest... > > I would like to see what rights the uid=admin user has for an entry: > Like I said "cn=directory > manager" has full rights - it bypasses all > access control. Just keep that in mind. > > Thanks, > Mark -- 389-users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://lists.fedoraproject.org/admin/lists/389-users@xxxxxxxxxxxxxxxxxxxxxxx
