Bjorn Oglefjorn wrote:
Thanks for the response Richard. This helps some, but how do I target the _members_ of, say 'cn=admins,ou=groups,dc=example,dc=com'?Hmm - not sure. I don't think this is possible. It doesn't appear that groupdn is supported in a target clause. If all of the entries could be identified by a search filter, you could use a (targetfilter=...) If you use Roles instead of groups, you could use targetfilter=(nsRole=dn_of_role_definition)).
Thanks again, --BOOn 4/2/07, * Richard Megginson* <rmeggins@xxxxxxxxxx <mailto:rmeggins@xxxxxxxxxx>> wrote:Bjorn Oglefjorn wrote: > Here's what I'm starting with: > > (targetattr = "userPassword" ) > (target = "ldap:///dc=example,dc=com";) > (version 3.0; > acl "Support can change passwords"; > allow (all) > (groupdn = "ldap:///cn=support,ou=groups,dc=example,dc=com";);) > > I just can't figure out how to write the exception. You can add a separate deny aci - deny takes precedence over allow. > --BO > > On 3/30/07, * Bjorn Oglefjorn* <sys.mailing@xxxxxxxxx <mailto:sys.mailing@xxxxxxxxx> > <mailto:sys.mailing@xxxxxxxxx <mailto:sys.mailing@xxxxxxxxx>>> wrote: > > Or maybe it's not so complicated and I don't know how. ;) > > This is what I'm trying to accomplish: > > Users who are a member of the group 'cn=support' > can perform ALL operations on 'userPassword', > except on targets which are a member of group 'cn=admins' or > 'cn=bosses'. > > Is this possible? I can't figure out how. Thanks in advance! > --BO > > > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users@xxxxxxxxxx <mailto:Fedora-directory-users@xxxxxxxxxx> > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx <mailto:Fedora-directory-users@xxxxxxxxxx> https://www.redhat.com/mailman/listinfo/fedora-directory-users <https://www.redhat.com/mailman/listinfo/fedora-directory-users> ------------------------------------------------------------------------ -- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
