hello mirco,
geht bei mir so… (Lenny)
rfc2307bis.schema #attributetype ( 1.3.6.1.1.1.1.0 NAME ‘uidNumber’ # DESC ‘An integer uniquely identifying a user in an administrative domain’ # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 # SINGLE-VALUE )
#attributetype ( 1.3.6.1.1.1.1.1 NAME ‘gidNumber’ # DESC ‘An integer uniquely identifying a group in an # administrative domain’ # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 # SINGLE-VALUE )
slapd.conf
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema #include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/rfc2307bis.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/qmail.schema
include /etc/ldap/schema/samba.schema
include /etc/ldap/schema/mozillaabpersonalpha.schema
include /etc/ldap/schema/evolutionperson.schema
…
…
acl_EGW_ADDRESSBOOK.conf # … and the entries CHILDREN
access to
dn.regex="cn=([^,]+),ou=personal,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by dn.regex=“uid=$1,ou=accounts,o=$2,ou=egw,$BASEDN” write
by users none
Access to groups addressbooks # allow read of addressbook by members and egwadmin account
access to
dn.regex="^cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"
attrs=entry
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” read
by dn.regex=“cn=egwadmin,o=$2,ou=egw,$BASEDN” write
by users none
allow members to create entries in there group addressbooks; no-one
else can access it # needs write access to the entries ENTRY attribute …
access to
dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"
attrs=children
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write
by users none
… and the entries CHILDREN
access to
dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write
by users none
access to dn.regex="^(.+,)?ou=contacts,o=([^,]+),ou=egw,$BASEDN$"
attrs=entry,children
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by dn.regex=“uid=egwadmin,ou=accounts,o=$1,ou=egw,$BASEDN” write
by dn.regex=“uid=(.*),ou=accounts,o=$2,ou=egw,$BASEDN$” search
by users none
access to dn.regex="(.)o=([^,]+),ou=egw,$BASEDN$"
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
by dn.regex=“uid=egwadmin,ou=accounts,o=$2,ou=egw,$BASEDN” write
by dn.regex="uid=(.),ou=accounts,o=$2,ou=egw,$BASEDN$" search
by users none
Hey!
Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider
bekomme ich immer noch die gleichen Fehlermeldungen.
Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind
alles Posix-Groups.
Gruß, Mirko
Do you use a schema, were groupOfNames can be used together with
posixGroup? Without groupOfNames expanding group memberships does NOT
work. That’s why we usually use the rfc2307bis schema instead of nis.
Using groupOfNames instead posixGroup (as some newer distributions do),
is not (yet) supported by EGroupware.
Ralf
Hallo zusammen,
ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich
beim ersten Speichern eine “Access denied” Fehlermeldung vom
LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch
nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,
erhalte ich dann: “…already exists”.
Die ACLs sind der mitgelieferten Datei entnommen:
olcAccess: to
dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read
by dn.regex=“cn=admin,dc=iaguar,dc=local” write
by users none
olcAccess: to
dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write
by users none
olcAccess: to
dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write
by users none
Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da
klappt alles, wie es soll.
Danke schonmal.
Mirko
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel® Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
egroupware-german mailing list
egroupware-german@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-german
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel® Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
egroupware-german mailing list
egroupware-german@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-german
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel® Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
egroupware-german mailing list
egroupware-german@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-german
