форумы  помощь  поиск  регистрация  майллист  вход/выход  слежка

Вариант для распечатки		Пред. тема | След. тема
Форумы OpenNET: Виртуальная конференция (Public)
Изначальное сообщение		[ Отслеживать ]

"LDAP - продвинутые ACL ?"

Сообщение от raba (ok) on 17-Июл-08, 11:43

Как реализовать нужеуказаные acl с помощью regex? access to dn.subtree="ou=dom3,dc=system,dc=ru"        by dn.one="ou=admin,ou=dom3,dc=system,dc=ru" write        by dn.children="ou=dom3,dc=system,dc=ru" read        by self read        by anonymous auth        by * none Прошу не указывать на http://www.openldap.org/doc/admin24/access-control.html , перечитал ее 10 раз но что-то не доходить до меня и не получается. Суть в том чтобы все которые находится в ou=dom3,dc=system,dc=ru могли читать только в свое дерево, дальше никуда, а все в ou=admin,ou=dom3,dc=system,dc=ru могли писать в тоже самое дерево. Все ето работает но как-то некрасиво и не грамотно звучить не переписывать его с regexы,..а если 50 поддерев, мне каждому отдельно прописывать :).. ?! Делаю я вот так: access to dn.regex="(.+,)?ou=([^,]+),dc=system,dc=ru$"        by dn.regex="(.+,)?$1,dc=system,dc=ru$$" read        by dn.regex="^cn=([^,]+),ou=admin,$1,dc=system,dc=ru$$" write        by * none

Высказать мнение | Ответить | Правка | Cообщить модератору

Сообщения по теме

[Сортировка по времени | RSS]

1. "LDAP - продвинутые ACL ?"

Сообщение от Hetzer (ok) on 17-Июл-08, 11:58

>Делаю я вот так: > >access to dn.regex="(.+,)?ou=([^,]+),dc=system,dc=ru$" >        by dn.regex="(.+,)?$1,dc=system,dc=ru$$" read >        by dn.regex="^cn=([^,]+),ou=admin,$1,dc=system,dc=ru$$" write >        by * none а что смущает? можно немного упростить, правда есть сомнение по self access to dn.regex="ou=([^,]+),dc=system,dc=ru$" attrs=children by group.exact="ou=admin,ou=$1,dc=system,dc=ru$" write by self read

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

	2. "LDAP - продвинутые ACL ?"
	Сообщение от raba (ok) on 17-Июл-08, 15:10
	Смущает того что не дает прочесть ничего, при таком растваление прав (моем), кстати забыл указать что ou=admin, ето не группа а просто контейнер 'ou', в которого нету аттр. 'member' ,а и при таком рсскладе он по правило-то и не дасть иметь таким атрибутом и соотвт. нельзя будет использовать директиву 'group.exact', или я что кое-что опустил?) При такови acl: access to dn.base="dc=ru"         by dn.children="ou=system,dc=ru" read         by * none access to dn.base="dc=system,dc=ru"         by dn.children="dc=system,dc=ru" read         by * none access to dn.regex="ou=([^,]+),dc=system,dc=ru$"         by dn.regex="(.+,)?$1,dc=system,dc=ru$$" read         by * none access to dn.regex="(.+,)?ou=([^,]+),dc=system,dc=ru$"         by dn.regex="(.+,)?$1,dc=system,dc=ru$$" read         by dn.regex="^cn=([^,]+),ou=admin,$1,dc=system,dc=ru$$" write         by * none логи таковы: Jul 17 14:52:18 ps3 slapd[1076]: => access_allowed: auth access to "cn=admin1,ou=admin,ou=dom3,dc=system,dc=ru" "userPassword" requested                                 Jul 17 14:52:18 ps3 slapd[1076]: => dn: [1] dc=ru                                                                                                                         Jul 17 14:52:18 ps3 slapd[1076]: => dn: [2] dc=system,dc=ru                                                                                                               Jul 17 14:52:18 ps3 slapd[1076]: => dnpat: [3] ou=([^,]+),dc=system,dc=ru$ nsub: 1                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: => acl_get: [3] matched                                                                                                                 Jul 17 14:52:18 ps3 slapd[1076]: => acl_get: [3] attr userPassword                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: => match[0]: 20 50                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: o                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: u                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: =                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: d                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: o                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: m                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: 3                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: ,                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: d                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: c                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: =                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: s                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: y                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: s                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: t                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: e                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: m                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: ,                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: d                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: c                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: =                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: r                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: u                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: => match[1]: 23 31                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: d                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: o                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: m                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: 3                                                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: => slap_access_allowed: result not in cache (userPassword)                                                                               Jul 17 14:52:18 ps3 slapd[1076]: => acl_mask: access to entry "cn=admin1,ou=admin,ou=dom3,dc=system,dc=ru", attr "userPassword" requested                                 Jul 17 14:52:18 ps3 slapd[1076]: => acl_mask: to value by "", (=0)                                                                                                       Jul 17 14:52:18 ps3 slapd[1076]: <= check a_dn_pat: (.+,)?$1,dc=system,dc=ru$$                                                                                           Jul 17 14:52:18 ps3 slapd[1076]: <= check a_dn_pat: *                                                                                                                     Jul 17 14:52:18 ps3 slapd[1076]: <= acl_mask: [2] applying none(=0) (stop)                                                                                               Jul 17 14:52:18 ps3 slapd[1076]: <= acl_mask: [2] mask: none(=0)                                                                                                         Jul 17 14:52:18 ps3 slapd[1076]: => slap_access_allowed: auth access denied by none(=0)                                                                                   Jul 17 14:52:18 ps3 slapd[1076]: => access_allowed: no more rules Посоветуйте, Очень надо))!
	Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

Архив | Удалить	Индекс форумов | Темы | Пред. тема | След. тема
Оцените тред (1=ужас, 5=супер)? [ 1 | 2 | 3 | 4 | 5 ] [Рекомендовать для помещения в FAQ]