☰

OpenLdap ACL 관리 그룹 권한

tag-icon • tag-icon openldap access-control-list
OpenLdap ACL 관리 그룹 권한

안녕하세요. 저는 관리자 및 운영자 수준 ACL을 달성하려고 노력했지만 소용이 없었습니다. 지금까지 나는

access to attrs=userPassword,shadowLastChange 
    by self write
    by anonymous auth
    by set="[cn=Administrators,ou=group,dc=company,dc=com]/member* & user" manage
    by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
    by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read
    by * none

access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,displayName,description,givenName
    by anonymous auth
    by self =rwdx
    by set="[cn=Administrators,ou=group,dc=company,dc=com]/member* & user" manage
    by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
    by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read

access to dn.subtree="dc=company,dc=com"
    by self =rwdx
    by set="[cn=Administrators,ou=groups,dc=company,dc=com]/member* & user" manage
    by set="[cn=Domain Admins,ou=groups,dc=company,dc=com]/memberUid* & user" manage
    by set="[cn=Operators,ou=groups,dc=company,dc=com]/member* & user" read
    by * break

관리자 및 도메인 관리자에게 모든 권한을 부여하고 운영자에게 읽기 액세스 권한을 부여해야 합니다. 위의 설정을 사용하면 관리자도 읽기 액세스 권한을 얻을 수 있습니다.

어떤 아이디어가 있나요? 감사해요

답변1

내 구성을 다음으로 변경했으며 지금은 작동하는 것 같습니다.

access to attrs=userPassword,sambaNTPassword,shadowLastChange
    by anonymous auth
    by self write
    by group.exact="cn=Administrators,ou=groups,dc=company,dc=com" manage
    by group.exact="cn=Operators,ou=groups,dc=company,dc=com" read

access to *
    by self write
    by dn.exact="uid=austek,ou=Technical,ou=people,dc=company,dc=com" manage
    by group.exact="cn=Administrators,ou=groups,dc=company,dc=com" manage
    by group.exact="cn=Operators,ou=groups,dc=company,dc=com" read
    by * break

관련 정보