Howto set access control lists ACLs in OpenLDAP

Question

I'm using the Debian Squeeze OpenLDAP. Where can I set ACLs? Isn't it possible to execute the access to directives with ldapmodify? There's no slapd.conf file in Debian, they use a slapd.d folder

Answer 1

Procedure is very similar to procedure of changing password that I described in another question.

There are also two ways.

1) Editing config file. You need to find config file of your backend. Each ACL is defined as value of olcAccess attribute. Syntax of ACL is identical as in "normal" slapd.conf file, but at the beginning of each ACL you must insert number that define "position" of ACL in ACL queue to check.

Example ACL entry looks like that:

olcAccess: {0}to * by anonymous write

2) Second way: using config database. If config database is enabled you could biind to it using LDAP client and edit olcAccess values for each backend.

Answer 2

I'm not saying this is a solution but it might help you on your way :-)

I asked a similar question of serverfault.

http://serverfault.com/questions/246252/openldap-rhel-6

I never got an answer , in the end I had to create a slapd.conf and convert it to the slapd dir using the following commands ( note this was on RHEL)

Remove the contents of the /etc/openldap/slapd.d/ directory:

rm -rf /etc/openldap/slapd.d/* 

Edit your custom slapd.conf file.

Run slaptest to check the validity of the configuration file and create a new slapd.d directory with your settings

slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d 

Configure permissions on the new directory so ldap doesnt moan.

chown -R ldap:ldap /etc/openldap/slapd.d 

chmod -R 000 /etc/openldap/slapd.d 

chmod -R u+rwX /etc/openldap/slapd.d 

the start up your LDAP server.

I created a small script to run these commands every time I made a change to slapd.conf

Regards Andy

Answer 3

The entire contents of slapd.d is concatenated together at runtime to generate a sort of pseudo slapd.conf file (that description isn't entirely exactly accurate, but I'm more trying to get the concept across). This is a common practice in Debian, and personally in many cases I highly prefer it.

Create a new file inside of slapd.d named acl (or similar, you will want to include a numbered prefix if other files have it) and put your ACL entries in there then restart slapd.

That should do it.* But be warned, that slapd's ACL structure can be difficult for the uninitiated. It's easy to do the wrong and/or unintended thing.

*Provided there aren't any sequence limitations (I don't know slapd that well, so you're on your own for that).