ACI limiting read to groups a user is member of

[Grant Byers <Grant.Byers@xxxxxxxxxxxxx>]

Hi,

In an effort to tighten search and read permissions on our internal 
directory server, we've limited accounts to read certain attributes of 
"self". They have search on the entire tree, but otherwise no read 
perms. This is all well and good for clients that utilize the memberOf 
attribute of self, but not so good for applications that utilize 
memberUid, or insist on searching for groupOfUniqueNames or 
groupOfNames  then enumerating them programmatically to determine which 
groups the user belongs to after binding as the user.

So. I've been reading docs and haven't been able to find anything, but I 
was wanting to do something like this;


dn: ou=groups,dc=example,dc=com
aci: (targetattr = "*")
  (targetfilter = "(&(objectClass=groupOfUniqueNames)(uniqueMember={{rdn 
of self}})")
  (version 3.0; acl "Allow authenticated users to read own group 
membership"; allow (read,compare,search)
  (userdn="ldap:///all";);)


where the target filter limits results to only those that match 
uniqueMember={{rdn of self}}


Is this possible?


Thanks,
Grant
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx