# Shared Addressbook LDAP: ACL Problem

**URL:** <https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012>\
**Category:** eGW-german\
**Created:** [September 5, 2010, 11:04pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012 "2010-09-05T23:04:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![micro](https://help.egroupware.org/letter_avatar_proxy/v4/letter/m/5f8ce5/32.png) [@micro](https://help.egroupware.org/u/micro)\
**Post date:** [September 5, 2010, 11:04pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/1 "2010-09-05T23:04:56Z")

</div>

Hallo zusammen,

ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
beim ersten Speichern eine “Access denied” Fehlermeldung vom  
LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
erhalte ich dann: “…already exists”.

Die ACLs sind der mitgelieferten Datei entnommen:

olcAccess: to  
dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
by users none

olcAccess: to  
dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
by users none

olcAccess: to  
dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
by users none

Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
klappt alles, wie es soll.

Danke schonmal.  
Mirko

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![Ralf\_Becker\_Stylite](https://help.egroupware.org/letter_avatar_proxy/v4/letter/r/45deac/32.png) [@Ralf\_Becker\_Stylite](https://help.egroupware.org/u/Ralf_Becker_Stylite)\
**Post date:** [September 6, 2010, 6:49am UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/2 "2010-09-06T06:49:55Z")

</div>

Do you use a schema, were groupOfNames can be used together with  
posixGroup? Without groupOfNames expanding group memberships does NOT  
work. That’s why we usually use the rfc2307bis schema instead of nis.

Using groupOfNames instead posixGroup (as some newer distributions do),  
is not (yet) supported by EGroupware.

Ralf

> Hallo zusammen,
> 
> ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> erhalte ich dann: “…already exists”.
> 
> Die ACLs sind der mitgelieferten Datei entnommen:
> 
> olcAccess: to  
> dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> by users none
> 
> olcAccess: to  
> dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> by users none
> 
> olcAccess: to  
> dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> by users none
> 
> Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> klappt alles, wie es soll.
> 
> Danke schonmal.  
> Mirko
> 
> * * *
> 
> This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> 
> Show off your parallel programming skills.  
> Enter the Intel® Threading Challenge 2010.  
> [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> 
> * * *
> 
> egroupware-german mailing list  
> [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

–  
Ralf Becker  
Director Software Development

Stylite GmbH  
[open style of IT]

Morschheimer Strasse 15  
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0  
fax +49 (0) 6352 70629-30  
mailto: [rb@stylite.de](mailto:rb@stylite.de)

[www.stylite.de](http://www.stylite.de)  
[www.egroupware.org](http://www.egroupware.org)

* * *

Geschäftsführer Andre Keller,  
Gudrun Müller, Ralf Becker  
Registergericht Kaiserslautern HRB 30575  
Umsatzsteuer-Id / VAT-Id: DE214280951

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![micro](https://help.egroupware.org/letter_avatar_proxy/v4/letter/m/5f8ce5/32.png) [@micro](https://help.egroupware.org/u/micro)\
**Post date:** [September 8, 2010, 3:29pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/3 "2010-09-08T15:29:42Z")

</div>

Hey!

Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider  
bekomme ich immer noch die gleichen Fehlermeldungen.

Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind  
alles Posix-Groups.

Gruß, Mirko

> Do you use a schema, were groupOfNames can be used together with  
> posixGroup? Without groupOfNames expanding group memberships does NOT  
> work. That’s why we usually use the rfc2307bis schema instead of nis.
> 
> Using groupOfNames instead posixGroup (as some newer distributions do),  
> is not (yet) supported by EGroupware.
> 
> Ralf
> 
> > Hallo zusammen,
> > 
> > ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> > beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> > LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> > nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> > erhalte ich dann: “…already exists”.
> > 
> > Die ACLs sind der mitgelieferten Datei entnommen:
> > 
> > olcAccess: to  
> > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> > by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> > by users none
> > 
> > olcAccess: to  
> > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > by users none
> > 
> > olcAccess: to  
> > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > by users none
> > 
> > Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> > klappt alles, wie es soll.
> > 
> > Danke schonmal.  
> > Mirko
> > 
> > * * *
> > 
> > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > 
> > Show off your parallel programming skills.  
> > Enter the Intel® Threading Challenge 2010.  
> > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > 
> > * * *
> > 
> > egroupware-german mailing list  
> > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![Ralf\_Becker\_Stylite](https://help.egroupware.org/letter_avatar_proxy/v4/letter/r/45deac/32.png) [@Ralf\_Becker\_Stylite](https://help.egroupware.org/u/Ralf_Becker_Stylite)\
**Post date:** [September 8, 2010, 4:33pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/4 "2010-09-08T16:33:55Z")

</div>

Ohne das du die Gruppen nochmal speicherst ändert sich da auch nichts.

Ansonsten ist LDAP ein komplexes Thema, das ich hier auf der Liste nicht  
vollständig behandeln kann. Im Zweifel hilft immer das log\_level in  
/etc/openldap/sldapd.conf hoch setzen und ins Log schauen.

Oder wenn alles zu kompliziert, den kommerziellen Support “bemühen”.

Ralf

> Hey!
> 
> Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider  
> bekomme ich immer noch die gleichen Fehlermeldungen.
> 
> Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind  
> alles Posix-Groups.
> 
> Gruß, Mirko
> 
> > Do you use a schema, were groupOfNames can be used together with  
> > posixGroup? Without groupOfNames expanding group memberships does NOT  
> > work. That’s why we usually use the rfc2307bis schema instead of nis.
> > 
> > Using groupOfNames instead posixGroup (as some newer distributions do),  
> > is not (yet) supported by EGroupware.
> > 
> > Ralf
> > 
> > > Hallo zusammen,
> > > 
> > > ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> > > beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> > > LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> > > nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> > > erhalte ich dann: “…already exists”.
> > > 
> > > Die ACLs sind der mitgelieferten Datei entnommen:
> > > 
> > > olcAccess: to  
> > > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> > > by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > olcAccess: to  
> > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > olcAccess: to  
> > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> > > klappt alles, wie es soll.
> > > 
> > > Danke schonmal.  
> > > Mirko
> > > 
> > > * * *
> > > 
> > > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > > 
> > > Show off your parallel programming skills.  
> > > Enter the Intel® Threading Challenge 2010.  
> > > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > > 
> > > * * *
> > > 
> > > egroupware-german mailing list  
> > > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> 
> * * *
> 
> This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> 
> Show off your parallel programming skills.  
> Enter the Intel® Threading Challenge 2010.  
> [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> 
> * * *
> 
> egroupware-german mailing list  
> [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

–  
Ralf Becker  
Director Software Development

Stylite GmbH  
[open style of IT]

Morschheimer Strasse 15  
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0  
fax +49 (0) 6352 70629-30  
mailto: [rb@stylite.de](mailto:rb@stylite.de)

[www.stylite.de](http://www.stylite.de)  
[www.egroupware.org](http://www.egroupware.org)

* * *

Geschäftsführer Andre Keller,  
Gudrun Müller, Ralf Becker  
Registergericht Kaiserslautern HRB 30575  
Umsatzsteuer-Id / VAT-Id: DE214280951

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![danfis](https://help.egroupware.org/letter_avatar_proxy/v4/letter/d/9f8e36/32.png) [@danfis](https://help.egroupware.org/u/danfis)\
**Post date:** [September 8, 2010, 7:16pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/5 "2010-09-08T19:16:12Z")

</div>

hello mirco,

geht bei mir so… (Lenny)

rfc2307bis.schema #attributetype ( 1.3.6.1.1.1.1.0 NAME ‘uidNumber’ # DESC ‘An integer uniquely identifying a user in an administrative domain’ # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 # SINGLE-VALUE )  
#attributetype ( 1.3.6.1.1.1.1.1 NAME ‘gidNumber’ # DESC ‘An integer uniquely identifying a group in an # administrative domain’ # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 # SINGLE-VALUE )

slapd.conf  
include /etc/ldap/schema/core.schema  
include /etc/ldap/schema/cosine.schema #include /etc/ldap/schema/nis.schema  
include /etc/ldap/schema/rfc2307bis.schema  
include /etc/ldap/schema/inetorgperson.schema  
include /etc/ldap/schema/qmail.schema  
include /etc/ldap/schema/samba.schema  
include /etc/ldap/schema/mozillaabpersonalpha.schema  
include /etc/ldap/schema/evolutionperson.schema  
…  
…

acl\_EGW\_ADDRESSBOOK.conf # … and the entries CHILDREN  
access to  
dn.regex="cn=([^,]+),ou=personal,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by dn.regex=“uid=$1,ou=accounts,o=$2,ou=egw,$BASEDN” write  
by users none

# Access to groups addressbooks # allow read of addressbook by members and egwadmin account

access to  
dn.regex="^cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
attrs=entry  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” read  
by dn.regex=“cn=egwadmin,o=$2,ou=egw,$BASEDN” write  
by users none

# allow members to create entries in there group addressbooks; no-one

else can access it # needs write access to the entries ENTRY attribute …  
access to  
dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
attrs=children  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
by users none

# … and the entries CHILDREN

access to  
dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
by users none

access to dn.regex="^(.+,)?ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
attrs=entry,children  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by dn.regex=“uid=egwadmin,ou=accounts,o=$1,ou=egw,$BASEDN” write  
by dn.regex=“uid=(.\*),ou=accounts,o=$2,ou=egw,$BASEDN$” search  
by users none

access to dn.regex="(._)o=([^,]+),ou=egw,$BASEDN$"  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
by dn.regex=“uid=egwadmin,ou=accounts,o=$2,ou=egw,$BASEDN” write  
by dn.regex="uid=(._),ou=accounts,o=$2,ou=egw,$BASEDN$" search  
by users none

> Hey!
> 
> Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider  
> bekomme ich immer noch die gleichen Fehlermeldungen.
> 
> Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind  
> alles Posix-Groups.
> 
> Gruß, Mirko
> 
> > Do you use a schema, were groupOfNames can be used together with  
> > posixGroup? Without groupOfNames expanding group memberships does NOT  
> > work. That’s why we usually use the rfc2307bis schema instead of nis.
> > 
> > Using groupOfNames instead posixGroup (as some newer distributions do),  
> > is not (yet) supported by EGroupware.
> > 
> > Ralf
> > 
> > > Hallo zusammen,
> > > 
> > > ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> > > beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> > > LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> > > nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> > > erhalte ich dann: “…already exists”.
> > > 
> > > Die ACLs sind der mitgelieferten Datei entnommen:
> > > 
> > > olcAccess: to  
> > > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> > > by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > olcAccess: to  
> > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > olcAccess: to  
> > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > by users none
> > > 
> > > Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> > > klappt alles, wie es soll.
> > > 
> > > Danke schonmal.  
> > > Mirko
> > > 
> > > * * *
> > > 
> > > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > > 
> > > Show off your parallel programming skills.  
> > > Enter the Intel® Threading Challenge 2010.  
> > > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > > 
> > > * * *
> > > 
> > > egroupware-german mailing list  
> > > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> 
> * * *
> 
> This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> 
> Show off your parallel programming skills.  
> Enter the Intel® Threading Challenge 2010.  
> [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> 
> * * *
> 
> egroupware-german mailing list  
> [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![danfis](https://help.egroupware.org/letter_avatar_proxy/v4/letter/d/9f8e36/32.png) [@danfis](https://help.egroupware.org/u/danfis)\
**Post date:** [September 8, 2010, 7:22pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/6 "2010-09-08T19:22:38Z")

</div>

ich vergass…

das brauchst natürlich nicht unbedingt, ich verwende das nur für interne dienste…  
by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read

> hello mirco,
> 
> geht bei mir so… (Lenny)
> 
> rfc2307bis.schema  
> #attributetype ( 1.3.6.1.1.1.1.0 NAME ‘uidNumber’
> 
> # DESC ‘An integer uniquely identifying a user in an administrative domain’
> 
> # EQUALITY integerMatch
> 
> # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
> 
> # SINGLE-VALUE )
> 
> #attributetype ( 1.3.6.1.1.1.1.1 NAME ‘gidNumber’
> 
> # DESC 'An integer uniquely identifying a group in an
> 
> # administrative domain’
> 
> # EQUALITY integerMatch
> 
> # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
> 
> # SINGLE-VALUE )
> 
> slapd.conf  
> include /etc/ldap/schema/core.schema  
> include /etc/ldap/schema/cosine.schema  
> #include /etc/ldap/schema/nis.schema  
> include /etc/ldap/schema/rfc2307bis.schema  
> include /etc/ldap/schema/inetorgperson.schema  
> include /etc/ldap/schema/qmail.schema  
> include /etc/ldap/schema/samba.schema  
> include /etc/ldap/schema/mozillaabpersonalpha.schema  
> include /etc/ldap/schema/evolutionperson.schema  
> …  
> …
> 
> acl\_EGW\_ADDRESSBOOK.conf
> 
> # … and the entries CHILDREN
> 
> access to  
> dn.regex="cn=([^,]+),ou=personal,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by dn.regex=“uid=$1,ou=accounts,o=$2,ou=egw,$BASEDN” write  
> by users none
> 
> # Access to groups addressbooks
> 
> # allow read of addressbook by members and egwadmin account
> 
> access to  
> dn.regex="^cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> attrs=entry  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” read  
> by dn.regex=“cn=egwadmin,o=$2,ou=egw,$BASEDN” write  
> by users none
> 
> # allow members to create entries in there group addressbooks; no-one
> 
> else can access it
> 
> # needs write access to the entries ENTRY attribute …
> 
> access to  
> dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> attrs=children  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
> by users none
> 
> # … and the entries CHILDREN
> 
> access to  
> dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
> by users none
> 
> access to dn.regex="^(.+,)?ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> attrs=entry,children  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by dn.regex=“uid=egwadmin,ou=accounts,o=$1,ou=egw,$BASEDN” write  
> by dn.regex=“uid=(.\*),ou=accounts,o=$2,ou=egw,$BASEDN$” search  
> by users none
> 
> access to dn.regex="(._)o=([^,]+),ou=egw,$BASEDN$"  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> by dn.regex=“uid=egwadmin,ou=accounts,o=$2,ou=egw,$BASEDN” write  
> by dn.regex="uid=(._),ou=accounts,o=$2,ou=egw,$BASEDN$" search  
> by users none
> 
> > Hey!
> > 
> > ```
> > Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider
> > 
> > ```
> > 
> > bekomme ich immer noch die gleichen Fehlermeldungen.
> > 
> > ```
> > Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind
> > 
> > ```
> > 
> > alles Posix-Groups.
> > 
> > ```
> > Gruß, Mirko
> > 
> > ```
> > 
> > > Do you use a schema, were groupOfNames can be used together with  
> > > posixGroup? Without groupOfNames expanding group memberships does NOT  
> > > work. That’s why we usually use the rfc2307bis schema instead of nis.
> > > 
> > > Using groupOfNames instead posixGroup (as some newer distributions do),  
> > > is not (yet) supported by EGroupware.
> > > 
> > > Ralf
> > > 
> > > > Hallo zusammen,
> > > > 
> > > > ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> > > > beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> > > > LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> > > > nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> > > > erhalte ich dann: “…already exists”.
> > > > 
> > > > Die ACLs sind der mitgelieferten Datei entnommen:
> > > > 
> > > > olcAccess: to  
> > > > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> > > > by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> > > > by users none
> > > > 
> > > > olcAccess: to  
> > > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > > by users none
> > > > 
> > > > olcAccess: to  
> > > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > > by users none
> > > > 
> > > > Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> > > > klappt alles, wie es soll.
> > > > 
> > > > Danke schonmal.  
> > > > Mirko
> > > > 
> > > > * * *
> > > > 
> > > > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > > > 
> > > > Show off your parallel programming skills.  
> > > > Enter the Intel® Threading Challenge 2010.  
> > > > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > > > 
> > > > * * *
> > > > 
> > > > egroupware-german mailing list  
> > > > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > > > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> > 
> > * * *
> > 
> > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > 
> > Show off your parallel programming skills.  
> > Enter the Intel® Threading Challenge 2010.  
> > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > 
> > * * *
> > 
> > egroupware-german mailing list  
> > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> 
> * * *
> 
> This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> 
> Show off your parallel programming skills.  
> Enter the Intel® Threading Challenge 2010.  
> [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> 
> * * *
> 
> egroupware-german mailing list  
> [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

---

<div class="post-metadata">

**Author:** ![danfis](https://help.egroupware.org/letter_avatar_proxy/v4/letter/d/9f8e36/32.png) [@danfis](https://help.egroupware.org/u/danfis)\
**Post date:** [September 8, 2010, 7:29pm UTC](https://help.egroupware.org/t/shared-addressbook-ldap-acl-problem/41012/7 "2010-09-08T19:29:55Z")

</div>

hm, nochwas vergessen:

$BASEDN

musst natürlich mit deinen werten ersetzen 😉

> ich vergass…
> 
> das brauchst natürlich nicht unbedingt, ich verwende das nur für interne dienste…  
> by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read
> 
> > ```
> > hello mirco,
> > 
> > ```
> > 
> > geht bei mir so… (Lenny)
> > 
> > rfc2307bis.schema  
> > #attributetype ( 1.3.6.1.1.1.1.0 NAME ‘uidNumber’
> > 
> > # DESC ‘An integer uniquely identifying a user in an administrative domain’
> > 
> > # EQUALITY integerMatch
> > 
> > # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
> > 
> > # SINGLE-VALUE )
> > 
> > #attributetype ( 1.3.6.1.1.1.1.1 NAME ‘gidNumber’
> > 
> > # DESC 'An integer uniquely identifying a group in an
> > 
> > # administrative domain’
> > 
> > # EQUALITY integerMatch
> > 
> > # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
> > 
> > # SINGLE-VALUE )
> > 
> > slapd.conf  
> > include /etc/ldap/schema/core.schema  
> > include /etc/ldap/schema/cosine.schema  
> > #include /etc/ldap/schema/nis.schema  
> > include /etc/ldap/schema/rfc2307bis.schema  
> > include /etc/ldap/schema/inetorgperson.schema  
> > include /etc/ldap/schema/qmail.schema  
> > include /etc/ldap/schema/samba.schema  
> > include /etc/ldap/schema/mozillaabpersonalpha.schema  
> > include /etc/ldap/schema/evolutionperson.schema  
> > …  
> > …
> > 
> > acl\_EGW\_ADDRESSBOOK.conf
> > 
> > # … and the entries CHILDREN
> > 
> > access to  
> > dn.regex="cn=([^,]+),ou=personal,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> > attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by dn.regex=“uid=$1,ou=accounts,o=$2,ou=egw,$BASEDN” write  
> > by users none
> > 
> > # Access to groups addressbooks
> > 
> > # allow read of addressbook by members and egwadmin account
> > 
> > access to  
> > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> > attrs=entry  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” read  
> > by dn.regex=“cn=egwadmin,o=$2,ou=egw,$BASEDN” write  
> > by users none
> > 
> > # allow members to create entries in there group addressbooks; no-one
> > 
> > else can access it
> > 
> > # needs write access to the entries ENTRY attribute …
> > 
> > access to  
> > dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> > attrs=children  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
> > by users none
> > 
> > # … and the entries CHILDREN
> > 
> > access to  
> > dn.regex="cn=([^,]+),ou=shared,ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> > attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by group.expand=“cn=$1,ou=groups,o=$2,ou=egw,$BASEDN” write  
> > by users none
> > 
> > access to dn.regex="^(.+,)?ou=contacts,o=([^,]+),ou=egw,$BASEDN$"  
> > attrs=entry,children  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by dn.regex=“uid=egwadmin,ou=accounts,o=$1,ou=egw,$BASEDN” write  
> > by dn.regex=“uid=(.\*),ou=accounts,o=$2,ou=egw,$BASEDN$” search  
> > by users none
> > 
> > access to dn.regex="(._)o=([^,]+),ou=egw,$BASEDN$"  
> > by dn=“uid=sysbind,ou=system,dc=iris,$BASEDN” read  
> > by dn.regex=“uid=egwadmin,ou=accounts,o=$2,ou=egw,$BASEDN” write  
> > by dn.regex="uid=(._),ou=accounts,o=$2,ou=egw,$BASEDN$" search  
> > by users none
> > 
> > > Hey!
> > > 
> > > ```
> > > Ich habe jetzt das nis gegen das rfc Schema ausgewechselt. Leider
> > > 
> > > ```
> > > 
> > > bekomme ich immer noch die gleichen Fehlermeldungen.
> > > 
> > > ```
> > > Die Gruppen enthalten auch keine groupOfNames Verweise. Es sind
> > > 
> > > ```
> > > 
> > > alles Posix-Groups.
> > > 
> > > ```
> > > Gruß, Mirko
> > > 
> > > ```
> > > 
> > > > Do you use a schema, were groupOfNames can be used together with  
> > > > posixGroup? Without groupOfNames expanding group memberships does NOT  
> > > > work. That’s why we usually use the rfc2307bis schema instead of nis.
> > > > 
> > > > Using groupOfNames instead posixGroup (as some newer distributions do),  
> > > > is not (yet) supported by EGroupware.
> > > > 
> > > > Ralf
> > > > 
> > > > > Hallo zusammen,
> > > > > 
> > > > > ich möchte gern Kontakte in einer Gruppe speichern. Leider erhalte ich  
> > > > > beim ersten Speichern eine “Access denied” Fehlermeldung vom  
> > > > > LDAP-Server. Allerdings wird ein Eintrag für die Gruppe angelegt, jedoch  
> > > > > nicht der Kontakt. Beim erneuten Versuch, den Kontakt zu speichern,  
> > > > > erhalte ich dann: “…already exists”.
> > > > > 
> > > > > Die ACLs sind der mitgelieferten Datei entnommen:
> > > > > 
> > > > > olcAccess: to  
> > > > > dn.regex="^cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$" attrs=entry  
> > > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” read  
> > > > > by dn.regex=“cn=admin,dc=iaguar,dc=local” write  
> > > > > by users none
> > > > > 
> > > > > olcAccess: to  
> > > > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=children  
> > > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > > > by users none
> > > > > 
> > > > > olcAccess: to  
> > > > > dn.regex=“cn=([^,]+),ou=shared,ou=contacts,ou=egroupware,dc=iaguar,dc=local$” attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha,@evolutionPerson  
> > > > > by group.expand=“cn=$1,ou=groups,dc=iaguar,dc=local” write  
> > > > > by users none
> > > > > 
> > > > > Ähnliche ACLs habe ich bereits für die persönlichen Addressbücher. Da  
> > > > > klappt alles, wie es soll.
> > > > > 
> > > > > Danke schonmal.  
> > > > > Mirko
> > > > > 
> > > > > * * *
> > > > > 
> > > > > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > > > > 
> > > > > Show off your parallel programming skills.  
> > > > > Enter the Intel® Threading Challenge 2010.  
> > > > > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > > > > 
> > > > > * * *
> > > > > 
> > > > > egroupware-german mailing list  
> > > > > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > > > > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> > > 
> > > * * *
> > > 
> > > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > > 
> > > Show off your parallel programming skills.  
> > > Enter the Intel® Threading Challenge 2010.  
> > > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > > 
> > > * * *
> > > 
> > > egroupware-german mailing list  
> > > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> > 
> > * * *
> > 
> > This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> > 
> > Show off your parallel programming skills.  
> > Enter the Intel® Threading Challenge 2010.  
> > [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> > 
> > * * *
> > 
> > egroupware-german mailing list  
> > [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> > [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)
> 
> * * *
> 
> This [SF.net](http://SF.net) Dev2Dev email is sponsored by:
> 
> Show off your parallel programming skills.  
> Enter the Intel® Threading Challenge 2010.  
> [http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)
> 
> * * *
> 
> egroupware-german mailing list  
> [egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
> [https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)

* * *

This [SF.net](http://SF.net) Dev2Dev email is sponsored by:

Show off your parallel programming skills.  
Enter the Intel® Threading Challenge 2010.  
[http://p.sf.net/sfu/intel-thread-sfd](http://p.sf.net/sfu/intel-thread-sfd)

* * *

egroupware-german mailing list  
[egroupware-german@lists.sourceforge.net](mailto:egroupware-german@lists.sourceforge.net)  
[https://lists.sourceforge.net/lists/listinfo/egroupware-german](https://lists.sourceforge.net/lists/listinfo/egroupware-german)