On Sat, 2009-07-25 at 17:00 -0500, Anthony Messina wrote: > On Saturday 25 July 2009 03:54:57 pm John A. Sullivan III wrote: > > Hmm . . . I've never used an ACI swapping attributes as your are (CN for > > UID) but I would think it should work. Out of curiosity, if you set the > > user's CN = UID and then rewrite the ACI to be ldap://($dn),....., does > > it work? > > Thanks for giving a good stab at this, John. I tried just changing the "cn" > for a user without changing the dn to read cn=amessina... (currently, > eGroupWare expects it to read uid=amessina...) That did not work. > > Is it to be expected, then, that one is not able to do something like: > > target = ldap://some_attr=($dn)... > > userdn = ldap://some_other_attr=($dn)... or > userdn = ldap://some_other_attr=[$dn]... > ??? > > In short, does the ($dn) macro in the target HAVE TO match the whole portion > between the commas, like "uid=amessina" rather than just "amessina": > > Can it do: > target = ldap://cn=($dn),ou=.... > or must it be: > target = ldap://($dn),ou=... > <snip> As I mentioned, I've never tried it using just the value and swapping attributes. I would expect it would work. We have used variable substitution very successfully in some quite complex ACIs. (target = "ldap:///($dn),o=internal,dc=ssiservices,dc=biz")(targetattr ! = "sambaLMPassword || sambaNTPassword || userPassword") (version 3.0;acl "Client Internal Directory Searcher";allow (read,compare,search)(userdn = "ldap:///uid=*dsearcher, [$dn],o=sysaccounts,dc=ssiservices,dc=biz");) I would have thought what you were doing would work just as you described. The biggest problem we have faced is not being able to use wildcards in groupdn although we can in userdn. I can say that using the complete attribute does work as advertised. Hopefully the gurus will return to the list soon! I'd like to know why what you have proposed doesn't work. Good luck - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@xxxxxxxxxxxxxxxxxxx http://www.spiritualoutreach.com Making Christianity intelligible to secular society -- 389 users mailing list 389-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
