Complicated ACI Definitions

On 3/30/07, Bjorn Oglefjorn < sys.mailinggmail.com">sys.mailinggmail.com> wrote:

Or maybe it's not so complicated and I don't know how. ;)

This is what I'm trying to accomplish:

Users who are a member of the group 'cn=support'
can perform ALL operations on 'userPassword';,
except on targets which are a member of group 'cn=admins' or 'cn=bosses'.&nbsp;

Is this possible?&nbsp; I can't figure out how.  Thanks in advance!
--BO

On 4/2/07, Richard Megginson < rmegginsredhat.com">rmegginsredhat.com> wrote:

Bjorn Oglefjorn wrote:
>; Here's what I'm starting with:
>
> (targetattr = "userPassword&quot; )
> (target = "ldap:///dc=example,dc=com&quot;)
> (version 3.0;
> acl "Support can change passwords&quot;;
&gt; allow (all)
> (groupdn = "ldap:///cn=support,ou=groups,dc=example,dc=com&quot;);)
>;
> I just can't figure out how to write the exception.
You can add a separate deny aci - deny takes precedence over allow.
&gt; --BO
>
> On 3/30/07, * Bjorn Oglefjorn* < sys.mailinggmail.com">sys.mailinggmail.com
> <mailto: sys.mailinggmail.com">sys.mailinggmail.com>> wrote:
&gt;
>&nbsp; &nbsp;  Or maybe it's not so complicated and I don't know how. ;)
>
&gt; &nbsp; &nbsp; This is what I'm trying to accomplish:
>
>  ; &nbsp; Users who are a member of the group 'cn=support'
> ; &nbsp;  can perform ALL operations on 'userPassword';,
>&nbsp; &nbsp;  except on targets which are a member of group 'cn=admins' or
>&nbsp; &nbsp;  'cn=bosses'.
>
>&nbsp; &nbsp;  Is this possible?&nbsp; I can't figure out how.  Thanks in advance!
>   ;  --BO
>
>
> ------------------------------------------------------------------------
>;
> --
> Fedora-directory-users mailing list
> Fedora-directory-usersredhat.com"> Fedora-directory-usersredhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
&gt;

--
Fedora-directory-users mailing list
Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users

On 4/2/07, Richard Megginson < rmegginsredhat.com">rmegginsredhat.com > wrote:

Bjorn Oglefjorn wrote:
>; Thanks for the response Richard.&nbsp; This helps some, but how do I target
&gt; the _members_ of, say 'cn=admins,ou=groups,dc=example,dc=com&#39;?
Hmm - not sure. ; I don't think this is possible.&nbsp; It doesn't appear that
groupdn is supported in a target clause.&nbsp; If all of the entries could be
identified by a search filter, you could use a (targetfilter=...)&nbsp; If
you use Roles instead of groups, you could use
targetfilter=(nsRole=dn_of_role_definition)).
>
> Thanks again,
>; --BO
>
> On 4/2/07, * Richard Megginson* < rmegginsredhat.com">rmegginsredhat.com
> <mailto: rmegginsredhat.com">rmegginsredhat.com>> wrote:
>;
> ; &nbsp;  Bjorn Oglefjorn wrote:
&gt; &nbsp; &nbsp; > Here's what I'm starting with:
>  ; &nbsp; >
>&nbsp;   ; > (targetattr = "userPassword&quot; )
>&nbsp; &nbsp;  > (target = "ldap:///dc=example,dc=com&quot;)
>  ; &nbsp; > (version 3.0;
>; &nbsp; &nbsp; > acl "Support can change passwords&quot;;
>  ; &nbsp; > allow (all)
>  ; &nbsp; > (groupdn = "ldap:///cn=support,ou=groups,dc=example,dc=com&quot;);)
>; &nbsp; &nbsp; >
>&nbsp;   ; > I just can't figure out how to write the exception.
>&nbsp; &nbsp;  You can add a separate deny aci - deny takes precedence over allow.
>; &nbsp; &nbsp; > --BO
>&nbsp;   ; >
>&nbsp;   ; > On 3/30/07, * Bjorn Oglefjorn* < sys.mailinggmail.com">sys.mailinggmail.com
>&nbsp; &nbsp;  <mailto: sys.mailinggmail.com">sys.mailinggmail.com>
>&nbsp; &nbsp;  > <mailto: sys.mailinggmail.com">sys.mailinggmail.com <mailto: sys.mailinggmail.com"> sys.mailinggmail.com>>>;
> ; &nbsp;  wrote:
>; &nbsp; &nbsp; >
>&nbsp;   ; >   ;  Or maybe it's not so complicated and I don't know how. ;)
>&nbsp; &nbsp;  >
>&nbsp;   ; >   ;  This is what I'm trying to accomplish:
>&nbsp; &nbsp;  >
>&nbsp;   ; >   ;  Users who are a member of the group 'cn=support'
> &nbsp;   >   ;  can perform ALL operations on 'userPassword';,
>&nbsp; &nbsp;  >   ;  except on targets which are a member of group 'cn=admins' or
>&nbsp;   ; >   ;  'cn=bosses'.
> &nbsp;   >
>&nbsp;   ; >   ;  Is this possible?&nbsp; I can't figure out how.  Thanks in advance!
&gt; &nbsp; &nbsp; >   ;  --BO
>&nbsp;   ; >
>&nbsp;   ; >
>&nbsp;   ; >
>; &nbsp; &nbsp; ------------------------------------------------------------------------
>; &nbsp; &nbsp; >
>&nbsp;   ; > --
>&nbsp; &nbsp;  > Fedora-directory-users mailing list
>&nbsp;   ; > Fedora-directory-usersredhat.com"> Fedora-directory-usersredhat.com
> ; &nbsp;  <mailto: Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com>
>&nbsp;   ; > https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   ;  >
>
> &nbsp;   --
>&nbsp; &nbsp;  Fedora-directory-users mailing list
>&nbsp;   ; Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com
>&nbsp; &nbsp;  <mailto: Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com>
>&nbsp;   ; https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   ;  <https://www.redhat.com/mailman/listinfo/fedora-directory-users&gt;
>
>;
>
> ------------------------------------------------------------------------
&gt;
> --
> Fedora-directory-users mailing list
> Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

--
Fedora-directory-users mailing list
Fedora-directory-usersredhat.com">Fedora-directory-usersredhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users