0

can you help me with rights for group OpenLdap 2.4?

There is my slapd.conf

# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2

#Basic rights for authentication
access to attrs=userPassword
    by self write
    by anonymous auth
    by * none

#Rights for groups GR_READ and GR_WRITE
access to *
  by self write
  by group.exact="cn=GR_READ,ou=groups,ou=BGA,o=Company,c=com" read
  by group.exact="cn=GR_WRITE,ou=groups,ou=BGA,o=Company,c=com" write
  by * none

This configuration work fine. I have people in groups with name GR_READ and GR_WRITE

But my problem is with synchronize DIT between two Openldap DB. Synchronization do not work! I recieved error findbase failed! 32 in slapd.log I have Multi-master configuration.

If I change configuration slapd.conf to this:

#Basic rights for authentication
access to attrs=userPassword
    by self write
    by anonymous auth
    by * none

#Rights for groups GR_READ and GR_WRITE
access to *
    by * read

Synchronization works! No errors in slapd.log. But I do not have a rights to my groups and anonymous user can bind LDAP.

Then I have another problem with disable anonymous. If I change

# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2

TO

disallow bind_anon

Synchronization do not work! I recieved error findbase failed! 32 in slapd.log

Thanks for help.

0

You have to specify bind information in the syncrepl statements and explicitly grant global read access to these entities preferably via another group REPLICAS.

Also I'd recommend to refactor your ACL like this:

access to *
  by group.exact="cn=REPLICAS,ou=groups,ou=BGA,o=Company,c=com" read
  by self write
  by group.exact="cn=GR_WRITE,ou=groups,ou=BGA,o=Company,c=com" write
  by group.exact="cn=GR_READ,ou=groups,ou=BGA,o=Company,c=com" read
  by * none

Otherwise users which are members of GR_WRITE and GR_READ cannot write. Order is significant: Control flow stops at first match!

Furthermore, I'd review whether by self write is secure for all your use-cases. But that's your security policy...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.